The European Commission is secretly preparing a major reform of its flagship data protection law amid industry pressure to roll out AI, according to leaked internal documents reported by various media outlets.
The leaked draft suggests the European Commission will give artificial intelligence (AI) companies (like Google, Meta or OpenAI) a free rein to collect Europeans’ personal data to train their AI models, according to Austrian privacy activist group NOYB.
The European Commission wants to simplify several EU laws, including GDPR, via the Omnibus reform, which is a "fast-track" procedure that jumps several elements of the process, including impact assessments and legal services feedback in EU institutions.
The idea is that this will cut regulations and help small businesses. It is in line with Former Italian Prime Minister Mario Draghi's report, which stated that the EU's flagship General Data Protection Regulation (GDPR) hindered European innovation on AI.
'Mainly for Big Tech'
However, the leaked changes would take aim at every element of GDPR that could limit AI usage.
Campaigners say the proposed changes are more likely to be a gift to Big Tech, mainly American companies that engage in AI training and are now valued in the trillions (like OpenAI, Google, Meta, Amazon or Microsoft).
"The draft is not just extreme, but also very poorly drafted. It is not helping 'small business', as promised, but again mainly benefiting 'Big Tech," said lawyer and NOYB founder, Max Schrems.
Under the new plans, the EU would revise core elements of the GDPR, including changing the definition of "personal data" by significantly narrowing its definition.
In this case, data protections, ensured under GDPR, would not apply in many cases. Campaigners argue this change would contravene the Court of Justice (CJEU)'s case law.
"I am surprised and concerned that the GDPR is being reopened and weakened at its core, including on the definition of what personal data is," Czech MEP Markéta Gregorová (Pirate Party, Greens/EFA), who is a European Parliament negotiator on the issue, told The Brussels Times.
MEP Markéta Gregorová speaking in the European Parliament. Credit: EU
"The potential changes that would allow greater flexibility for AI training are particularly troubling, as they could open the door to the use of personal and sensitive data without sufficient safeguards," she added. "Our fundamental rights must carry more weight than financial interests."
Indeed, the special protection of sensitive data like health data, political views or sexual orientation would also be significantly reduced under these leaked plans.
This would be done by limiting protections to only when such sensitive information is "directly revealed".
However, privacy campaigners NOYB say that people who reveal information about themselves online usually need this protection less than those whose sensitive details can only be "deduced" from other information.
Tracking your devices
Also included in the plans, would be to allow remote access to personal data on computers or smart phones without consent of the user, under the guise of legitimate interest.
The Commission plans to prepare up to 10 legal bases to pull information from a personal device – or place tracking technology on your device (such as cookies). According to NOYB’s legal analysis, the wording is "extremely permissive" and would also allow "excessive searches" on user devices for minor security purposes.
European Commissioner to Tech Henna Virkkunen speaking at an event on 16 October 2025. Credit: EU
"The same applies to any attempt to weaken the current rules on cookies and integrity of our terminals, which rely on user consent as their cornerstone," MEP Gregorová underlined.
The rules are set to enable the training of AI models with European citizens' personal data, but privacy activists say "liberating AI" would have massive unintended consequences for many other areas of GDPR.
The Socialists & Democrats (S&D) group in the European Parliament have also penned a letter addressed to European Commissioner for Tech, Henna Virkkunen, to say they are concerned with the "watering down" of flagship law, to the point where it may not be applicable anymore.
"Simplification has been a priority for this Commission," a European Commission spokesperson told The Brussels Times on Wednesday.
"More broadly, this is about helping European companies remain globally competitive and strengthening Europe’s technological sovereignty, while ensuring strong protection of European citizens’ rights through the safeguards provided under the GDPR."
The Commission confirmed the possibility that targeted amendments to the GDPR are under discussion as part of its work on the digital omnibus, which will be presented by on 19 November.
"The aim is to make the GDPR more operational, not to weaken it. However, no formal decisions have been taken at this stage," the spokesperson added.
German pressure
Any proposal would need to find agreement in the European Parliament and European Council, where it could face significant opposition. Most EU Member States are not in favour of any major revision of the GDPR.
According to NOYB, Germany pushed for significant changes in another draft leaked last week, which largely reflects the European Commission’s proposals. It is unclear why Germany is pushing for these changes, but it has been vocal proponent of speeding up the roll out of AI in Europe.
"It is unclear where the political pressure comes from. Most Member States asked for tiny changes… We are not surprised that this latest push comes from Germany again," said NOYB's Schrems. "There is reporting that also pressure from the US could play a role."
He pointed to recent reporting by Politico that Virkkunen's message to US businesses in direct meetings was that the EU will review its rules and become more business-friendly.
"The leak of the Commission digital omnibus reveals that the Commission has been working on a much more far reaching plan that it had announced," MEP Gregorova added.
"Yet, the Commission is not planning to undertake an impact assessment. This raises serious doubts about its capacity to properly consider the implications for the enforcement of our fundamental rights."
