The Council’s revised Digital Omnibus text appears to permit legitimate-interest processing for AI, but regulators warn that its unclear wording could create a new layer of legal uncertainty.
On 21 October, the Council of the European Union adopted a revised Digital Omnibus text that is now set to form the basis of trilogue talks on the final shape of the regulation. At the centre of the new draft is a politically sensitive question: whether legitimate interest can serve as a legal basis for processing personal data in the development and operation of artificial intelligence systems. According to the text now on the table, the answer appears to be yes, but only within the framework already laid down by the GDPR.
That is precisely where the confusion begins. The draft inserts a new Article 88bis on processing in the context of AI development and operation, stating that such processing may be carried out on the basis of legitimate interest under Article 6(1)(f) of the GDPR. But it also says the controller must still choose an appropriate lawful basis and must apply technical and organisational safeguards, including measures designed to protect the rights and freedoms of the data subject. The wording is broad enough to be read in two very different ways: either as a simple restatement of existing GDPR rules, or as an attempt to create a special regime for AI-related processing.
The Council’s accompanying recital seems to pull back from the more expansive reading. It says legitimate interest may be used, where appropriate, unless those interests are overridden by the rights and freedoms of the individual, especially where the data subject is a child or where EU or national law expressly requires consent. It adds that AI development and operation are not, by themselves, legitimate interests and that reliance on Article 6(1)(f) must be assessed case by case, taking account of the underlying purpose of the processing. In other words, the recital points back towards the ordinary GDPR balancing exercise rather than a privileged AI-specific rule.
That interpretation is close to the position already taken by the European Data Protection Board and the European Data Protection Supervisor in their joint opinion on the Digital Omnibus. They said there was no need for a separate provision restating that legitimate interest can be a lawful basis for AI-related processing, because the EDPB had already confirmed that point in Opinion 28/2024. They also warned that, if the co-legislators insisted on keeping such a clause, the text would need tighter drafting to avoid legal uncertainty.
Their recommendation was not merely to repeat existing law, but to spell out how the lawful-basis test should work in practice. The supervisory bodies urged the legislators to make clear that controllers relying on legitimate interest must still pass the familiar three-part assessment: identifying a legitimate aim, showing necessity, and balancing that aim against the interests and rights of the individual. They also said the draft should expressly link the AI provision to that existing test, rather than implying that AI development or operation can automatically justify processing.
The same concern appears in the treatment of the right to object. The EDPB and EDPS welcomed an unconditional objection right in principle, but advised that it should be anchored directly in Article 21 of the GDPR, specifically for AI-related processing based on legitimate interest. They further said individuals should be told about that right as early as possible, because data may be difficult to remove once it has been absorbed into a model or system. The Council, however, did not carry over that stronger formulation. Instead, it appears to have left data subjects with the ordinary objection right that already applies under the GDPR.
The supervisory authorities also pushed for greater clarity on transparency, mitigation measures and terminology. They said any “enhanced transparency” requirement should mean more than the basic information duties under Articles 13 and 14 of the GDPR, and warned that mitigation measures should not be confused with the legal obligations controllers already owe under data protection law. They also called for the term “operation” of an AI system to be defined, noting that it is not currently defined in either the GDPR or the AI Act. None of those clarifications appears to have made it into the Council’s adopted text.
The result is a draft that may be intended as simplification but risks doing the opposite. Consumer groups such as BEUC have warned that the Digital Omnibus could weaken the balance the GDPR struck between innovation and fundamental rights, particularly if AI developers are allowed to rely too easily on legitimate interest for large-scale data use. Even where the Council’s recital softens the impact of the new Article 88bis, the broader message remains unsettled: the legislature seems to be moving towards a more permissive posture on AI data use, while the data protection institutions insist that the existing rules already provide the necessary legal framework. The coming trilogue will determine whether that tension is resolved by clearer drafting, or whether Europe ends up with another layer of uncertainty over a field that is already difficult to regulate.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
