The EU once set global standards for privacy and AI; now it is retreating

The European Commission is expected to publish the Digital Omnibus reform package on November 19, which could reshape three digital rules: the GDPR, the AI Act, and ePrivacy. According to an analysis of a leaked draft by the Austrian privacy NGO noyb, the package will narrow the definition of personal data, limit people's rights to access and delete their data, protect sensitive data only when explicitly disclosed, and add a new exception allowing companies to use personal data to train AI on legitimate interest grounds. According to MLex, Reuters, and the Financial Times, enforcement of the AI Act may be delayed, deployers of high-risk systems may get a one-year grace period, and penalties for transparency violations are postponed to August 2027; civil society organizations warn that the draft allows companies to declare high-risk systems as low-risk themselves without registration. ePrivacy is proposed to be merged into the GDPR, and the cookie consent mechanism would shift from opt-in to near opt-out. Privacy advocates criticize the package for moving on a fast track without preparing impact assessments.