Detailed breakdown of key changes in the GDPR Omnibus draft

Key points from (& thoughts on) draft GDPR Digital Omnibus:

First, Art. 4(1) GDPR would be completed with an SRB-like statement (great news), plus a mitigation of abusive interpretation of the Scania judgment (also great news).

Art. 4(15) on “data concerning health” would also finally be more specific, avoiding some of the more awkward and negative consequences of Lindenapotheke.

The clarification in Art. 9(1) that only *direct* revelations of special topics are taken into account is similarly significant.

The “legitimate interest” equivalent for AI model training added re special categories of data is a useful addition, with a focus notably on risk mitigation at the level of outputs – a very sensible move.

Next, we have common sense “implied information” situations that are added to Art. 13 GDPR on transparency – a welcome addition for the most basic types of processing activities (though be mindful of exceptions to that implied information situation).

The tweak to Art. 22 GDPR is interesting, as it suggests that contractual necessity for automated decision-making (ADM) is not necessity of ADM but necessity of decision-making. I’m not very keen on the “regardless of whether” wording, though – I would have chosen different words.

The “single-entry point” for data breach notifications + the extension to 96h (vs 72h) are great, as handling international data breaches is a pain now. Intended as a common process also for NIS2/DORA/…

On DPIAs, we might finally get EU-wide EDPB-made lists of “DPIA required” and “no DPIA required” scenarios, but the timeline (number of months) still has to be determined.

And then come new articles, after Art. 88, to integrate ePrivacy & AI aspects into the GDPR.

On ePrivacy, the focus would lie on *personal data* – the processing of personal data on or from terminal equipment of a data subject – and would include as a legal justification (i) communication transmission, (ii) “providing a service” (= no longer “information society service”) “explicitly requested by the data subject”, (iii) “own” aggregation of information about usage to measure the audience of a service and (iv) security of the service or of the terminal equipment used for provision of the service.

Then, “[f]or any other purpose that those referred in the first subparagraph the processing shall comply with Article 6 and, where applicable, with Article 9.

Even if you want to use consent for other purposes, there are consent limits (accept or refuse: single-click button or equivalent means; choice respected for at least [6] months by default).

Art. 88b will be of interest to those involved in standard-setting re user choices.

And then Art. 88c rounds it up with an explicit reference to legitimate interests as legal ground for AI model development & operation.

EDIT: link to document: https://lnkd.in/epd5ia_Z

EDIT 2: thoughts on the actual proposal: https://lnkd.in/eXRWUfvA
Data protection privacy