Ambassadors of the Twenty-Seven have approved the resumption of negotiations on an amendment to the GDPR that would allow artificial intelligence models to train on users’ personal data without their consent. The noyb association sees this as a “digital expropriation”. The text is still only at the discussion stage.
- EU ambassadors approved resuming talks on a GDPR amendment.
- The amendment would let AI companies train on personal data without consent, based on presumed consent.
- Companies could invoke «legitimate interest,» and sensitive data accidentally used would not make them liable.
- The privacy association noyb calls it «digital expropriation,» and no official timetable exists yet.
On October 21, the Committee of Permanent Representatives of the European Union, better known as the ambassadors of the Twenty-Seven, gave the green light to resume negotiations on this amendment, which aims to incorporate it into the General Data Protection Regulation (GDPR). As early as September, the Vienna-based European association noyb had opposed the European Council’s proposal, which it described as “nothing less than the digital expropriation of Europeans”. Following the announcement of the resumption of discussions, the association became even more critical. Max Schrems, honorary chairman of noyb, sees it as “the complete handover of European data to multinationals”.
A “Legitimate Interest” as a Lever
Concretely, the new Article 88 bis of the GDPR would allow invoking “legitimate interest” to develop and operate AI from personal data, without the consent of the data subject. This principle is based on presumed consent: in other words, “silence implies consent”. According to this same article, the only exceptions would be cases where European Union law or the law of the country concerned explicitly requires consent. When the person is a child, the processing of their data would, however, require consent.
The Council’s text also mentions Article 9, whose second paragraph refers to sensitive data, such as data relating to an illness. However, to train a model, its operator ingests enormous quantities of texts and photos, which inevitably include sensitive information. It is impossible to sort everything manually, and the European Council intends to regulate this type of data used by companies like OpenAI or Anthropic.
The Council proposes that if such data accidentally ends up in the training computations, the company should neither be considered at fault nor liable to sanctions under European law. It should, however, make a serious effort to avoid them, for example by filtering them at the collection stage. The text neither quantifies nor clearly defines the limits of this effort. If the company identifies sensitive data, it must delete it without delay.
This text, described as controversial, remains at the negotiation stage within the European Council, and no official timetable has yet been established.
