The debate over the concept of personal data

The Digital Omnibus and the dispute over what counts as personal data

The European Commission's Digital Omnibus, presented in November 2025, aims to simplify certain requirements of the EU's digital legislation, including certain provisions of the GDPR. One of its most contested GDPR changes would add entity-specific wording to the definition of personal data. Under the proposed text, information would not be personal data for an entity that could not identify the individual using the means reasonably likely to be used by that entity, and would not become personal for that entity merely because a potential subsequent recipient could identify the person. The EDPB and the EDPS objected particularly to that final element, arguing that it goes beyond the case law of the Court of Justice of the EU, would significantly narrow the concept of personal data and increase legal uncertainty.

This does not mean the EDPB rejects entity-specific analysis altogether. Its later draft anonymisation guidelines say that whether data is anonymous may vary from one entity to another. The dispute is how far that approach goes, especially where data may be passed to a recipient that can identify the person.

In their Joint Opinion 2/2026 of 10 February 2026, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) backed the goals of simplification and competitiveness. At the same time, they noted that narrowing the concept of personal data would increase legal uncertainty and make it harder to assess the legal status of pseudonymised data. The data protection organisation noyb shared this criticism.

In the Cyprus Presidency compromise text dated 20 February 2026, the Commission's proposed amendment to the definition of personal data was removed. However, the document was only a draft prepared for negotiations within the Council and did not represent an agreed Council position. Negotiations continued over the following months, but the Cyprus Presidency was unable to secure the necessary support among Member States and withdrew the compromise text from the COREPER II approval process at the end of June. As of 2 September 2026, the proposal remained under legislative consideration and the question of the definition of personal data remained unresolved.

The Digital Omnibus package originally comprised two separate legislative proposals. The proposal on artificial intelligence has already been adopted as Regulation (EU) 2026/1744 and entered into force on 27 July 2026. The broader proposal, which also contains the GDPR amendments, remains under legislative consideration.

The GDPR applies only to information that qualifies as personal data. Narrowing that concept could therefore leave some data, including certain uses of pseudonymised data, outside the scope of the regulation.