Notes from the IAPP Europe: Digital Omnibus progress, health data and online scams and fraud

A few months have passed since the European Union's AI Omnibus entered into force, but the simplification exercise isn't yet finished for the Digital Omnibus package. As the counterpart to the AI Omnibus, the Digital Omnibus — which proposes targeted amendments to the EU data protection, privacy and cybersecurity frameworks — is still riding the EU's legislative train. 

Last week that train reached the next stop on its route. After many discussions and divided opinions between national ministers, the Council of the EU has finally reached an agreement on its negotiating position on the file, despite resistance from Austria, Estonia and Germany.

In relation to the EU General Data Protection Regulation, the Council keeps the current definition of personal data, adding a separate provision clarifying pseudonymization and identification of a natural person. The data subject access requests rules are simplified to address the burden of unfounded and excessive requests. The derogation allowing for the processing of special categories of personal data in the context of biometric verification and AI development and operation is supplemented by additional data minimization, end-to-end-encryption and other safeguards. The mandate also supports an increased timeframe for personal data breach notifications.

The part of the Council's negotiating position that concerns the EU's data frameworks introduces stronger protection of trade secrets and supports the differentiation of charges for data reuse depending on the size of an enterprise. 

The Council proposes keeping the rules on cookies and other tracking technologies under the e-Privacy Directive but with certain changes, such as introducing additional exemptions under which consent won't be required.

On the cybersecurity side, the initial Commission proposal for an EU level single-entry point for data incident reporting is amended, suggesting establishing such points at a member-state level instead. To ensure harmonization past country-level, the Council proposes establishing an EU-level incident reporting information point.

There are still many stops to pass until it can be said that the Digital Omnibus train is nearing its final station. The rapporteurs' opinion still has to be adopted and backed up by members of European Parliament. Only then can the institutions continue the journey and work together on defining the final scope of the law during the trilogues, which are expected to start early next year. 

There were also some developments concerning the implementation of the European Health Data Space. The European Commission released three draft templates on the secondary use of health data. The templates, to be used by health data access bodies, trusted health data holders and health data applicants, address submission procedures for health data access applications, health data permits and submission of health data requests. 

On 16 Oct., the European Commission opened a public consultation on the draft templates, and several responses, including from national public bodies, have already been received. A common piece of criticism among the submissions concerns the practicality of the templates, including that they are "not adapted for machine use or use in a web interface." Stakeholders are invited to provide feedback until mid-November.  

During the month of October, there was also a lot of activity in connection to the Digital Services Act. In terms of its enforcement, the Commission started to investigate Booking.com's compliance with the law, namely its efforts in addressing scams and fraud, and adherence to transparency obligations concerning the labeling of certain listings as advertisements. The Commission also previously investigated efforts to combat illegal listings by the e-commerce platform Temu, concluding that the DSA had been breached. Temu's plan to address its breaches was accepted by the Commission earlier this week. 

With a proliferation of online scams and fraud, the Commission is thinking about an instrument to address the issue. In October, it held discussions with banking and payment service providers, as well as trusted flaggers, civil society and consumer organizations on the idea of a voluntary Code of Conduct on online fraud and scams under the DSA. The discussion on whether such an instrument should be developed will continue next month, this time between the Commission and online platforms.