EU member states have agreed a negotiating position on plans to simplify parts of the bloc’s rules on data protection, online privacy and cyber incident reporting.
The proposal is part of the EU’s “Omnibus VII” package under a wider simplification agenda, and would amend rules including the General Data Protection Regulation (GDPR) — the EU’s main law on personal data — while keeping protections for personal information, the Council of the EU announced on Wednesday.
The package also includes changes affecting online tracking rules under the e-privacy directive and a new approach to reporting cybersecurity and data incidents.
Irish foreign affairs and trade minister Helen McEntee said the agreement would “simplify and streamline the EU’s digital rulebook” while “maintaining high standards for data privacy and citizens’ rights”.
What could change for GDPR, cookies and incident reporting
Under the Council’s mandate, the GDPR would keep its current definition of personal data, while new wording would clarify “pseudonymisation” — a technique that reduces the ability to link data back to an individual — and when someone is considered identifiable.
The Council also backed changes intended to simplify how organisations respond to “unfounded or excessive” requests, and some “low risk” situations linked to information obligations under the GDPR.
On research, the mandate supports a principle-based definition of “scientific research” and introduces targeted exemptions to certain obligations when personal data is processed for that purpose.
The Council said it also added safeguards to a proposed derogation that would allow processing of sensitive personal data for biometric verification and in the development and operation of artificial intelligence systems.
For cookies and similar online trackers, the Council said it would keep the e-privacy directive framework but clarify additional situations where consent would not be required — including when cookies are necessary to provide a service, measure audiences or ensure device security — with the effect of reducing the number of cookie banners users see online.
On cyber and data incident reporting, the Council emphasised that it would replace the idea of a single EU-level reporting entry point with a national entry point in each member state, alongside an EU-level information point and provisions aimed at more harmonised and cross-border notification.
The Council said negotiations with the European Parliament would begin once MEPs agree their own position.
