EU Council proposes allowing AI training with personal data without consent

Coreper, which brings together ambassadors from EU member states, approved the position the Council of the European Union will take into negotiations with the European Parliament on the Digital Omnibus. The proposal would create Article 88 bis of the GDPR, allowing companies to develop and operate AI models using personal data based on their own or a third party’s legitimate interest, without individual consent. The GDPR already provides for that legal basis in other uses, but the change would apply it explicitly to AI.

The Council’s text would also remove safeguards added by the European Commission, including an unconditional right to object and specific exceptions for minors and laws requiring consent. Sensitive data captured incidentally and residually could be processed if it was not deliberately collected, provided it is avoided, deleted and protected once detected. Thomas Byrne, Ireland’s minister of state, said the measures would reduce compliance costs and boost competitiveness and innovation. The proposal is not yet law.