Overview
- Drafts propose letting AI developers rely on legitimate interest to train models on personal data and create exceptions to process sensitive data, departing from current GDPR safeguards.
- The text would narrow what counts as personal data by carving out some pseudonymized datasets and would fold parts of the ePrivacy cookie regime into GDPR with broader justifications for device access.
- AI Act relief in the draft includes exemptions from registering certain high‑risk systems used only for narrow or procedural tasks, a one‑year penalty grace period until August 2, 2027, and transitional labeling delays for AI‑generated content.
- Privacy groups Noyb and EDRi warn the package amounts to a downgrade of protections, criticize the lack of impact assessments, and argue the approach could let companies infer sensitive traits without Article 9 safeguards.
- The Commission plans to present the proposal on November 19, though the text may still change and any final measures require agreement from EU member states and the European Parliament.