Our response to the official text of the EU Digital Omnibus Regulation Proposal

The digital Omnibus, the simplification package for EU digital regulation, was published on 19 November.

Michael Birtwistle, Associate Director for Law and Policy at the Ada Lovelace Institute, said:

‘If passed, the Omnibus will be the most significant and extraordinary reversal in digital rights in a generation, leaving the EU with worse personal data protection than, for instance, California in some respects.

The EU Commission’s ambitions are not limited to the GDPR, the ePrivacy Directive and the AI Act. With the Digital Fitness Check public consultation (also launched today), all EU digital regulation is in scope for further changes, including the Digital Markets Act and the Digital Services Act, which are essential mechanisms for responsible market practices, competition and democratic integrity.

The Commission’s claim that the proposed amendments are ‘technical in nature’ is evidently false. The Omnibus effectively disapplies swathes of GDPR safeguards in the interests of AI development and use and alters the core presumption that people should have control over their own data.

Changes of this magnitude are deeply inappropriate for the low-scrutiny process of the Omnibus and go far beyond the mandate provided by the Commission’s consultation evidence. The Commission is failing to be transparent that the overwhelming beneficiaries of these changes will be large, non-EU tech companies.

The impact of the changes, if passed, will be profound. They will legitimise existing unlawful AI training practices and mass non-consensual data trading. They will expose people to increasingly more automated decision-making. They will let companies decide if it is too expensive to give effect to people’s data rights and unilaterally exempt themselves from the AI Act.

Economically, the Omnibus would be deeply damaging to the shape and character of the future EU AI market. It would incentivise ‘race to the bottom’ compliance behaviours, penalise companies pursuing responsible AI, and challenge the push for greater European sovereignty.

Risk from AI would shift away from developers and onto adopters, reducing mechanisms that make risks visible and addressable, and stripping people of agency over their digital lives.

The EU Parliament and Member States should demand the immediate withdrawal of these proposals. They should request the basic evidence necessary to contemplate such radical changes: full economic and fundamental rights impact assessments and transparency over the evidence received by the Commission in support of the proposals.’

Editor’s note: Following today’s publication, the proposals will require the approval of the European Parliament and the European Council.