Analysis of the GDPR and Data Act Omnibus draft

From fishing (instead of the GDPR) to a random “v” having appeared instead of a few words (a typo upon deletion?), the Commission’s GDPR & Data Act Omnibus feels like a rushed document. But what does it cover really?

I’m focussing here on GDPR & ePrivacy:

– Personal data definition: I like the idea of SRB integration. Does it truly “limit” Scania? The fact that data is “indirectly” personal data for someone doesn’t actually make the GDPR apply to that someone, only to the actual (subsequent or prior) controller.

– No more clarification of the awkward OT judgment of the CJEU on special categories of data (SCDs). It’s really a missed opportunity, but I have no doubt there will be further cases to clarify and redress the bar to make the idea of SCD processing workable (see my earlier post on this particular topic: https://lnkd.in/eKfnjCQw ).

– AI model training & operation provisions: these remain (from the draft), but one notable change to the new GDPR Art. 9(5) appears to unnecessarily reinforce the burden of proof of appropriateness of measures to avoid the processing of SCDs (seemingly making that avoidance an obligation of result, which appears unrealistic).

– The possibility to refuse to act in the event of abuse by a data subject of his/her rights remains in the proposal, but it’s limited to Art. 15 GDPR. Sounds like a reasonable limitation.

– Art. 13 additions are good and sensible. The new one on scientific research derogations is also helpful.

– The changes to automated decision-making (Art. 22) remain as in the leak. I questioned specific phrasing for not being ideal linguistically, but the intention is good.

– On data breaches (Art. 33), the ENISA formula may finally retire, as the EDPB has to prepare “a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person”. The 96h timeframe and single-entry point mechanism from the leak remain.

– The evolutive nature of pseudonymisation is confirmed, with the Commission being allowed to “adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities” (new Art. 41a).

– The GDPR & ePrivacy Art. 5(3) marriage remains partial, with big questions still remaining regarding notably analytics & security storage for scenarios not involving personal data.

– The AI training “legitimate interest” provision (new 88c) remains similar to that of the leak, now also with a new illustration of a measure for the rights of data subjects: “providing data subjects with an unconditional right to object to the processing of their personal data”. It’s an illustration, though, not a requirement.

– Various things are still not there. No reinforcement of e.g. contract as a viable legal ground, no additional pragmatism on international data transfers etc. For the next Omnibus?