As per a report by the IAPP, the Council of the EU agreed on October 21 its negotiating position on the data part of the Digital Omnibus. The Council's press release says the proposal amends the General Data Protection Regulation (GDPR), modernises the cookie rules in the ePrivacy Directive, repeals provisions of the platform-to-business regulation, consolidates single-market data rules, and introduces a mechanism for a single reporting point for cybersecurity and data incidents, while maintaining strong levels of protection for personal data.

IAPP reports that member states kept the GDPR's existing definition of personal data, rejecting the Commission's proposed amendment to Article 4(1), and added a provision on pseudonymisation standards. It quotes European Data Protection Supervisor Wojciech Wiewiórowski as having warned that the Commission's changes "would significantly narrow the concept of personal data." On AI, the Council text adds clarifications on the lawful ground for processing personal data for AI training, with appropriate safeguards, and new safeguards on sensitive data that allow its use in biometric verification and AI model training. On cookies, consent would not be needed when a cookie is necessary to provide a service, for audience measurement, or to secure the user's device. IAPP reports that member states preferred national reporting portals to an EU-level one for incident notification, within a harmonised framework. The Council says negotiations with the European Parliament will begin once Parliament adopts its own position, so this is a Council mandate and not agreed law.