EU governments have agreed a common negotiating position on proposed changes to data protection, online privacy and cyber-incident reporting rules. The Council of the European Union approved its mandate on 21 October, allowing its presidency to prepare for talks with the European Parliament once MEPs have adopted their own position.
The decision does not change the law immediately. It sets out the approach member states want to take in negotiations on the Digital Omnibus proposal. Any final measure would still need agreement between the Council and Parliament before it could be adopted and applied.
Changes proposed for data protection rules
The mandate covers amendments to the General Data Protection Regulation, known as the GDPR, alongside parts of the EU’s wider data framework. It would keep the existing definition of personal data, while adding a provision intended to clarify pseudonymisation and when a person can be identified.
Pseudonymisation involves handling information so it cannot be linked to an individual without additional data. The Council says the proposed clarification is intended to help organisations apply their GDPR duties. The mandate also supports simpler requirements for dealing with unfounded or excessive requests, and for some information obligations in lower-risk circumstances. Those changes remain proposals rather than revised obligations for organisations today.
For scientific research, the Council backs a principle-based definition designed to make rules on processing personal data more consistent. It also envisages targeted exemptions from some duties for research organisations. The mandate includes safeguards around a proposed derogation for sensitive data used in biometric verification and in the development and operation of artificial-intelligence systems.
Cookies, data reuse and trade secrets
The position keeps the current legal framework for cookies and other online tracking technologies under the e-privacy directive. It would specify additional situations in which consent would not be needed to place cookies on a device, including where this is necessary to provide a service, measure an audience or protect the security of a user’s device. The Council says that approach could reduce the number of cookie banners people encounter online.
It also proposes to consolidate rules on data altruism and data-intermediation services. Public bodies holding public-sector data could be able to set different conditions, and in some cases higher charges, for reuse by very large companies and firms designated as gatekeepers. A separate measure would strengthen safeguards where trade secrets are at risk of being disclosed to third countries, requiring protective steps before disclosure.
National route for reporting incidents
A significant difference in the Council’s position concerns the handling of cyber-security and data incidents. Rather than a single EU-level entry point proposed earlier in the process, the mandate calls for a national entry point in every member state. The aim is to support reporting of incidents and related events that fall under different EU laws.
The mandate would also create an EU-level information point and set out provisions for a more harmonised approach to incident notification, including cross-border reports. The details of how national routes, the information point and existing reporting duties would work together would depend on the final legislation and later implementation.
Negotiations still to come
The Council’s approval is a procedural step, not a final settlement of the policy. Its presidency can begin negotiations only after the European Parliament has adopted a negotiating position of its own. The two institutions would then need to resolve their differences on the proposed changes to privacy, data use and reporting. Until that process is complete, organisations remain subject to the rules currently in force rather than the simplifications set out in the mandate.
