The Council of the European Union has approved a proposal to amend the GDPR aiming to consider the processing of personal data in the context of artificial intelligence (AI) as lawful by default.

This amendment, integrated into a new Article 88 bis within the "Digital Omnibus proposal," would allow AI-specialized companies such as OpenAI, Google, or Meta to use all personal data collected over decades without major restrictions. The processing would be deemed lawful by presuming an overriding "legitimate interest," without requiring the consent of the data subjects. This approach, described as "digital expropriation," would prioritize the commercial interests of companies over the right to data protection. The text adds references to Article 21 and Article 24 of the GDPR, but these are considered to provide no additional concrete safeguards.

Furthermore, the proposal approved by the Council suggests restricting the definition of "personal data," which could exclude pseudonymized data such as tracking identifiers or IP addresses from the scope of the GDPR. The Council's agreement is not final; the text must now be negotiated with the European Parliament and the European Commission within the framework of the "trilogues." The possibility of the law being invalidated by the Court of Justice of the European Union is mentioned due to potential infringements of fundamental rights.