EU agrees on AI data rules

On Wednesday, October 21, EU member states signed an agreement that could expand the use of personal data by AI companies, according to reports. The agreement includes Article 88b of the General Data Protection Regulation (GDPR), part of the Digital Omnibus, a set of measures aimed at easing the EU's digital rules.

New article allows AI data processing

Article 88b allows companies to process personal data "in the context of the development and operation" of an AI system or model based on their legitimate interest or that of a third party. This could bypass the need for consent if the company's interest is deemed to outweigh the rights of the affected individuals.

Pseudonymization rule added

The Council also created Article 25 bis on pseudonymization, which involves replacing a person's name with an identifier. Under this rule, a third-party company that cannot trace the person's identity would no longer process personal data.

Concerns over data tracking

According to the association Noyb, most computer systems operate with this type of identifier, such as tracking identifiers or IP addresses, meaning online tracking could fall outside the scope of the GDPR. It would mainly be up to the companies themselves to decide whether a piece of data remains personal.

GDPR’s strict data rules

Since May 25, 2018, the GDPR has required companies to justify every data processing with a specific purpose, such as fighting fraud. Noyb states that Article 88b authorizes an entire technology, regardless of its use. The association uses the example of personalized advertising without consent, which is currently prohibited in the EU but could become legal if it is done through AI.

Big tech could benefit most

This measure would first benefit those who have already accumulated huge volumes of European data, such as Google, Meta, Microsoft, OpenAI, Anthropic, or SpaceX. Europe already depends on American actors on sensitive issues, with recent reports indicating that private messages from Europeans go through the American software Palantir.

Legal challenges ahead

The text is not yet a law. The member states must negotiate its final version with the European Parliament, which has not yet taken a position. If the text is adopted as is, the association is counting on the Court of Justice of the EU, which has previously annulled European texts for less serious violations, such as data retention or their transfer to the United States.