European governments are considering a change to the GDPR that would make it easier for companies to use personal data to develop and operate AI systems without first obtaining individual consent.
A revised Digital Omnibus compromise drafted by Ireland, which currently holds the presidency of the Council of the EU, introduces a new Article 88bis. The provision says personal data may be processed for AI development or operation on the basis of a company’s “legitimate interest” under the GDPR. That could allow an AI developer to use certain personal information contained in training datasets without asking every affected person for permission first.
The proposal does not mean that AI companies would automatically be free to use any personal data they can obtain. “Legitimate interest” is an existing GDPR legal basis with its own conditions. The processing must be necessary for a legitimate purpose and must be balanced against the individual’s rights and freedoms. Consent is also not universally required for AI training under today’s GDPR. The European Data Protection Board has already concluded that legitimate interest can sometimes be used for developing AI models, depending on the circumstances.
What makes the new draft controversial is that it would write this possibility specifically into the GDPR for AI. Compared with the European Commission’s original proposal, the Council text also removes several explicit safeguards from the operative article, including an unconditional right to object and wording specifically highlighting children and situations where consent is required by other laws. General GDPR protections would still apply.
Privacy group noyb argues that the change could make it significantly easier for large technology companies to reuse personal information originally collected for other purposes. European data-protection regulators have taken a more nuanced position. They accept that legitimate interest can sometimes apply, but previously argued that a special AI-specific provision was unnecessary. The measure is far from final. The September 3 document is a Council negotiating text, not adopted EU law, and any final legislation must also be agreed with the European Parliament.