EU member states finalize negotiating stance on Digital Omnibus

The Irish Presidency of the Council of the European Union announced an agreement on EU member states' negotiating position for the proposed Digital Omnibus aimed at amending and simplifying the EU's digital rulebook, including the EU General Data Protection Regulation, the ePrivacy Directive and more.

Notably, the council agreed to maintain the GDPR's existing definition of personal data and introduced an amendment outlining pseudonymization standards to ensure organizations are compliant when processing data. With third-party cookies, the omnibus seeks to limit cookie banners by updating the ePrivacy Directive's provisions for instances where cookie placement notifications are not required.

The European Commission first unveiled the omnibus in November 2025. Institutions can proceed to trilogue negotiations once European Parliament reaches consensus on its negotiating stance.

Despite various setbacks in negotiations, Ireland Minister of State for European Affairs and Defence Minister Thomas Byrne said the Council's agreement is aligned with the One Europe, One Market roadmap.

In a statement, Byrne noted Ireland's council presidency will continue to "simplify rules on data protection, privacy and cybersecurity for businesses, public administrations and citizens, while maintaining established policy goals. These measures will reduce compliance costs and boost competitiveness and innovation."

GDPR reform

The Commission previously proposed an amendment to Article 4(1) of the GDPR that would have established that data is not necessarily considered personal even if the data could be used to identify an individual. EU member states opposed the change dating back to February and held firm in its negotiating agreement.

Member states' thinking was supported by a joint opinion European Data Protection Board and European Data Protection Supervisor released pushing back against the changes due to the potential implications for pseudonymized data.

EDPS Wojciech Wiewiórowski highlighted the Court of Justice of the European Union's position clarifying personal data, noting if the changes were passed it "would significantly narrow the concept of personal data."

"We must make sure that any changes to the GDPR … actually clarify obligations and bring legal certainty while maintaining trust and a high level of protection of individual rights and freedoms," Wiewiórowski said.

Among the other proposed GDPR amendments in the council's mandate are new safeguards on sensitive data to allow its use in biometric verification and artificial intelligence model training. Member states also introduced "clarifications on the lawful ground for processing personal data and need to maintain appropriate safeguards" in the context of AI training data.

In an IAPP op-ed, Morrison & Foerster Senior Of Counsel Lokke Moerel offered her perspective on how the Commission's original proposals to simplify AI training via GDPR reform "miss the mark and create more issues than they simplify."

Cookies and incident reporting

The ePrivacy Directive was first adopted and entered into force in 2002. EU institutions have haggled over potential modernization at different points in recent years before ultimately choosing to address aspects of the framework in the omnibus.

The council's negotiating mandate laid out specific instances where consent would not be required moving forward, including when "necessary for the provision of a service, for the purpose of audience measurement or for ensuring the security of the user's device." when cookies are necessary to provide services or identify whether a device is considered secure.

During its initial omnibus drafting, the Commission highlighted its intent behind ePrivacy changes was to provide "pragmatic and immediate clarifications to limit consent fatigue, provide legal clarity on rightful access and processing, and enhanced data availability to businesses."

Ireland's Foreign Affairs and Trade Minister Helen McEntee noted efforts to streamline these requirements "will make it easier for businesses to operate across Europe, reducing administrative burdens while maintaining high standards for data privacy and citizens' rights."

On cybersecurity incident reporting, the council's position opposed an EU-level reporting portal in favor of national portals that respect the nuances in member states' laws. However, the mandate does seek to establish "specific provisions towards a harmonised framework for incident notification and on cross-border incident notifications."

The Commission previously stated the current incident reporting landscape required "immediate measures for simplifying compliance with the requirements and for the use of reporting tools are necessary."

The agreement proposed establishing incident report entry points within individual EU member states instead of the Commission's proposed "single EU-level" cybersecurity entry point.