The Council of the EU agreed its negotiating mandate on the Digital Omnibus Regulation, which amends the GDPR, the ePrivacy Directive, the EUDPR and the Data Act. The mandate keeps the current definition of personal data but states that pseudonymised data is not personal data for a recipient without reasonable means to reidentify the individual. It allows processing for AI development to rely on legitimate interest, subject to a right to object and added safeguards for children. It would also limit breach notification to the supervisory authority to breaches likely to result in high risk, and add exemptions to cookie consent for security updates, audience measurement and requested functionality. This is a Council position only. Trilogue begins once Parliament adopts its own position.
Pseudonymised data could fall outside the GDPR for recipients that cannot reasonably reidentify individuals.
Processing for AI development could rely on legitimate interest, with a right to object and safeguards for children.
Breach notification to the authority and cookie consent rules would narrow, but the final text still depends on Parliament.
Our comment
The mandate would change several assumptions built into current GDPR programs, including the scope of personal data, the legal basis for AI training and breach notification thresholds. Since the final text depends on negotiations with Parliament, the relevant question for now is which internal processes would be affected if these positions hold.
Questions about this alert?
Sara Derbel
Paralegal
Our team can explain what this development means for your organization.
Regulatory intelligence and legislative monitoring for AI, privacy and cybersecurity across Canada, the US, EU, UK and Australia, filtered, prioritized and reviewed by legal experts.
Privacy compliance for Law 25, PIPEDA, GDPR and ISO 27701: gap analyses, audits, individual rights frameworks and proportionate corrective plans for SMEs and complex tech environments.
Privacy program design and implementation for Law 25, GDPR and ISO 27701: governance, retention, consent, training, privacy officer support and certification readiness.
Guidelines from the Garante require organizations using tracking pixels in marketing emails to obtain prior, free, specific and informed consent before the pixel collects information about whether and when a recipient opened the email. A pixel that can be traced back to a single recipient is treated as a tracking technology subject to the same consent standard as website cookies. The guidelines rest on Article 122 of the Italian Privacy Code, which implements Article 5(3) of the ePrivacy Directive. The compliance period ended on October 29, 2026, and the Garante has included verification of these guidelines in its planned inspections for the second half of 2026.
The Office of the Privacy Commissioner of Canada released its comments on Innovation, Science and Economic Development Canada's consultation on AI transparency, which ran from July 23 to September 23, 2026. The OPC agrees that transparency issues arise in all five areas ISED identified: AI generated content, AI interaction, information about AI systems, AI incidents and AI agents. It argues that information about a system must be understandable at the point where it affects an individual's decision. The OPC anchors its position in its existing consent guidelines and names developers and deployers of generative AI as bearing transparency responsibilities.
The Commission d'accès à l'information published new guidance on dark patterns, meaning interface designs that steer users toward decisions against their own interest. Examples include disclosing more personal information, spending more time on a platform or spending more money. The CAI states that consent obtained through such an interface may be invalid, which would make the resulting use or communication of personal information unlawful. The guidance sets out the applicable legal obligations and best practices for organizations that collect personal information from Quebec users online.
