AI: EU Member States approve “digital expropriation” for AI companies
EU Member States approve GDPR amendment allowing unrestricted AI company data use without consent.
Run Google?
Get an email when a reviewed story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
EU Member States have approved a controversial GDPR amendment (Article 88bis) that automatically permits personal data processing "in the context of AI" without user consent or restrictions. The change would allow major AI companies like OpenAI, Google, Meta, and others to use decades of collected personal data for AI training and products, effectively overriding European data protection rights. Privacy advocates like Max Schrems criticize the amendment as "digital expropriation" that prioritizes corporate profits over fundamental privacy rights and benefits US tech companies over EU firms.
The lesson from this incident
Full lessonThe approval of GDPR Article 88bis represents a fundamental weakening of the regulatory framework that has historically protected EU citizens' personal data rights. By automatically permitting AI companies to process personal data without user consent, the amendment creates a systemic loophole that undermines the foundational principles of purpose limitation and data minimisation enshrined in GDPR. This matters because decades of personal data—collected under strict consent conditions—could now be repurposed for AI training without individual knowledge or recourse. The amendment demonstrates how legislative changes can erode data protection at scale, far more broadly than any single technical breach, and sets a dangerous precedent for corporate data exploitation under the guise of technological progress.