Overview
- The Commission adopted the package on November 20, opening EU‑level negotiations on a broad rewrite intended to cut bureaucracy and boost competitiveness.
- The proposal consolidates multiple instruments — including Open Data rules, the Free Flow of Non‑Personal Data framework, the Data Governance Act and the EU Data Act — into a single Data Act.
- Application of substantial AI Act obligations for general‑purpose models would be pushed back by more than a year, with expanded exemptions for SMEs also on the table.
- Privacy and consumer groups attack the draft for weakening GDPR, warning of curtailed access rights, a narrower definition of personal data, and a new Article 88c that would treat AI training using personal data as a legitimate interest.
- The package touts centralized cookie preferences set in browsers or operating systems and flags a European Business Wallet targeted for 2029, though experts say the cookie fix remains technically and legally unclear.