EU member states have agreed on a plan to change Europe’s main data privacy law. The changes could make it easier for companies to use personal data to build and run artificial intelligence (AI) systems.
Privacy activist Max Schrems has attacked the plan sharply. He says it could weaken the control Europeans have over their personal information. The plan is not final law, though. The European Parliament must set its own position before talks can move forward.
Council backs new rules for AI data use
The Council of the European Union approved its negotiating position on October 21, 2026, according to its official announcement. The position covers changes to the General Data Protection Regulation (GDPR). The GDPR is the EU’s main law on how organisations handle personal data. The changes could affect how firms use Europeans’ information for AI systems.
The plan is part of the EU’s Digital Omnibus package. This package aims to simplify digital rules and reduce paperwork for businesses. The Council says the changes should support innovation and competition. It also says personal data will stay protected.
One part of the plan has drawn the most attention. The Council’s text adds a new rule called Article 88bis. Under this rule, a company may rely on “legitimate interest” when it handles personal data to build or run an AI system or model. That idea comes from Article 6(1)(f) of the GDPR.
Legitimate interest already exists in EU law. It lets organisations process personal data without consent in certain cases. Companies still have to follow the other data protection rules.
The new rule would give AI developers a clearer way to argue that their work serves a legitimate interest. Critics say this could make it easier to train AI models on data from online services and social media. Companies would not need fresh consent from every person.
The text does not give companies free rein, however. It says AI development does not automatically count as a legitimate interest. Regulators must judge each case by looking at the purpose of the data use, as a related provision explains. Companies must also choose a proper legal basis. They must keep technical and organizational safeguards in place. The wider proposal also mentions the right to object under Article 21 of the GDPR.
Privacy group noyb hits back at the plan
The privacy group noyb, founded by Austrian activist Max Schrems, published its reaction on October 23. The group criticised the Council’s decision strongly. Schrems called the move a form of digital seizure of people’s data. He argued it ranks the business interests of AI companies above the basic right to data protection.
According to noyb, big technology companies could use huge amounts of old personal data to develop AI. That could include data from people who never used their services directly. The group also doubted that the safeguards in the text would protect people well. It questioned whether they would stop excessive data collection.
It also asked whether they would block uses that people did not reasonably expect. The EU has also scrutinized how major online platforms handle personal information, including TikTok’s privacy and data processing practices.
Two EU privacy bodies have shared views on this topic before. The European Data Protection Board and the European Data Protection Supervisor said legitimate interest can sometimes support AI development. They made this point in a joint opinion on the Digital Omnibus in February 2026. The same joint opinion also raised concerns about the proposed data protection changes. Both bodies called for suitable safeguards.
Parliament still has the final say
The Council’s approval does not turn the plan into law. It only sets the position of the member states. The EU lawmaking process is still unfinished. The European Parliament must now set its own position. Only then can talks begin between Parliament, the Council and the European Commission. Those talks are meant to produce an agreed text.
Until that happens, the current GDPR rules stay in force. Companies cannot treat the Council’s position as blanket permission. They cannot use it to collect and use personal data for AI training.
The debate shows a growing clash inside the EU. The bloc wants to strengthen its AI industry. It also has a long record of protecting personal information. Supporters of simpler rules say clearer laws could help businesses innovate. Privacy advocates warn that wider legal grounds could weaken control over information people shared for other reasons.
The final outcome will show how the EU balances these goals. It will also decide what legal protections people keep as AI development grows.
