[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCPljWVJvtBC2bJ8YhImwQtTCnCx8VH3MJndzQ_J4c5I":3},{"article":4,"iocs":56,"watch_terms":57,"solutions":58,"lesson":61},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"82ff8ccc-4d5e-436c-be81-27b02575eade","AI: EU Member States approve “digital expropriation” for AI companies","ai-eu-member-states-approve-digital-expropriation-for-ai-companies-4238ef","GDPR Policy On Wednesday, EU Member States approved a change to the GDPR that would put the profit-making interests of OpenAI, Anthropic, Google, Meta and SpaceX over European's fundamental right to data protection. According to the approved text, processing personal data “in the context of AI” should automatically be lawful. In particular, Big Tech would be able to use all personal data collected over the past decades with virtually no restrictions, as long as this happens “in the context” of AI. Schrems: “Under the agreed text, the profits of AI companies would typically trump European’s fundamental right to privacy. This is nothing but a digital expropriation of Europeans.” All this is happening despite the key figures of AI corporations actively warning about the enormous risks associated with their own products. Text approved by the Council on Wednesday, published on Thursday Last limits fall: Profits of AI companies trump data protection? As part of the \"Digital Omnibus\" Proposal, the European Commission claimed it would only make minor changes to simplify things for EU companies. At the same time, it explicitly claimed to maintain a “high level of protection” for people in Europe. Therefore, a “fast-track procedure” was chosen. This was done without carrying out a fundamental rights assessment or directly involving the European expert group on data protection. Article 88c, as proposed by the European Commission (now Article 88bis in the Council document), intends to liberate the use of personal data for AI. The proposal is currently with the Council, where the Irish Presidency currently holds the reins. Ireland also serves as the EU headquarter for the majority of the US and Chinese AI corporations. Digital expropriation: approved in the Council. With the support of Germany and other EU powerhouses, the Council (representing EU Member States) on Wednesday approved that companies should generally be permitted to do basically anything when using personal data \"in the context of AI\". This means that the commercial interests of AI companies would generally trump the fundamental rights of users. This general allowance would also apply to people who have never been customers of an AI company and to data entered decades ago, for example in chats or on social media. All personal data that an AI company can somehow get its hands on would fall under the provision. There would be no need to ask users for consent. Instead, it is automatically assumed that companies have an overriding \"legitimate interest\" if they use or train any AI product. The Council has added a reference to the existing rights and duties under Article 21 (a right to an opt-out in specific cases) and Article 24 GDPR (the need for technical and organisational implementation of legal duties), but these alleged \"safeguards\" would apply to any processing even without that reference. In essence, no material safeguards are required by the new Article 88bis on AI. Max Schrems: “On Wednesday, the EU Member States have agreed to take our data and feed it to AI companies for free. For decades, we have been telling people that their data is safe and, at best, is used for ads. Now, Google, Meta and Microsoft can just use all the data they've collected with almost no limits and for any project that involves some 'AI' component. This is the biggest gift that EU Member States have ever made to US Big Tech.” The sale of European data to the US and China. Politicians seem to believe that the European economy will benefit from the abolishment of as many laws as possible. Nonetheless, the exact opposite can be expected: most EU companies neither have the access to the same volume of data nor the capital to compete with US corporations. In many cases, this could also mean that the data collected by EU companies (but processed on platforms or services outside the EU) would flow to providers in the US or China. Max Schrems: “This legislative change primarily benefits the big players, those who have collected massive amounts of European data. This is a total sell-off of European data to global corporations. It would also result in a large amount of know-how flowing from EU companies to the US or China. From an industrial policy perspective, such an approach is madness.” A blank check for an entire technology? Usually, the GDPR permits processing for specific purposes (e.g. retention for tax records or fraud prevention). However, the agreed Article 88c (or Article 88bis) legitimises an entire technology. Regardless of the purpose for which it is used, any AI system could lawfully take any personal data by default. For example, the proposed Article would also permit the training and use of AI for manipulation, disinformation, the generation of nude images or killer drones, and indeed any other questionable purpose. Many processing operations that were so far illegal could suddenly become legal – just because they are done “in the context” of an AI system. For example, data processing for personal advertising purposes (without consent) is currently illegal in the EU. Now, however, advertising could suddenly become legal if it is personalised using AI technology. Max Schrems: “It’s like saying anything goes – no matter what you do – as long as it’s done with AI. If something is illegal in an Excel spreadsheet, it's legal if done with an AI agent. It’s utterly absurd to give preferential treatment to a high-risk technology over every other computer system.” The 45-year promise of data protection is collapsing. On a European level, data protection legislation has existed since 1981. For decades, Europeans have been promised that such (supposedly) “strict” data protection would ensure that platforms such as Twitter\u002FX, Facebook or Instagram, and corporations such as Google or Microsoft, which collect vast amounts of data, would “never” use it for other purposes that for what they were shared. The proposed Article 88c (or now 88bis) breaks this promise: all collected data is suddenly up for grabs for any use by any AI system. Max Schrems: “Since the 1980s, we have promised people that while large corporations may hold onto data, they are only permitted to use it to a limited extent. However, Article 88bis suddenly opens the floodgates and allows unlimited use of all data for AI.\" Further massive limitations on protections and rights. Furthermore, EU member states have proposed to drastically narrow the definition of “personal data”. This means that, among other things, it is unclear whether online tracking would still be covered by the GDPR. This is supposed to be done using so-called \"pseudonyms\", which should regularly not be covered by the GDPR anymore. The problem is that most IT systems primarily work with pseudonyms (such as user IDs, tracking IDs, IP addresses or social security numbers). The decision of whether data is still “personal” would be primarily made by the companies that are regulated by the law. Such debates typically drag on for years and drown procedures in enormous delays and enormous costs – so anything but \"simplification\". Max Schrems: “These changes are right out of the playbook of any big law firm defending big tech. We've spent years in courts and before authorities to get these claims rejected. The EU legislator will likely turbocharge them and hence make EU law even more complex and unenforceable.” Next Battleground: The European Parliament. This agreement is not an agreement on the final law. The Council has to negotiate the final wording with the European Parliament, which is yet to take a position. The European Commission is the third institution involved in the so-called \"Trilogues\" that will lead to a final EU law. The Commission has already made a 180-degree turn a while ago and currently clearly prioritises the interests of industry lobbies over fundamental rights. The position of the European Parliament is still in the making. Whilst most of the European People’s Party (EPP) tend to argue in favour of putting more and more loopholes in EU digital laws, Members of the European Parliament from the center-left fractions have so far pushed back and favour keeping the status quo. Increasingly, also far-rights groups oppose proposals for a “free pass” for Big Tech. Last hope: The Court of Justice? The main question seems to be whether a law without any meaningful restrictions can in any way be reconciled with EU fundamental rights. In the past, the European Court of Justice has struck down EU law in cases involving much less significant infringements of EU fundamental rights, such as data retention or the transfer of EU data to the United States. Max Schrems: “If the legislator has lost all sense of proportion and direction, the people can only turn to the courts. Any extreme law that has a high risk of being overturned would at the same time only create more legal uncertainty instead of promised simplification.”","EU Member States have approved a controversial GDPR amendment (Article 88bis) that automatically permits personal data processing \"in the context of AI\" without user consent or restrictions. The change would allow major AI companies like OpenAI, Google, Meta, and others to use decades of collected personal data for AI training and products, effectively overriding European data protection rights. Privacy advocates like Max Schrems criticize the amendment as \"digital expropriation\" that prioritizes corporate profits over fundamental privacy rights and benefits US tech companies over EU firms.","EU Member States approve GDPR amendment allowing unrestricted AI company data use without consent.","https:\u002F\u002Fnoyb.eu\u002Fen\u002Fai-eu-member-states-approve-digital-expropriation-europeans-ai-companies","https:\u002F\u002Fnoyb.eu\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffacebook\u002Fpublic\u002F2026-10\u002Fmember_states_approve.png?h=48f39255&itok=c-fbGus_","2026-10-23T10:00:00+00:00","2026-10-23T12:00:15.135538+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"OpenAI","vendor",{"name":21,"type":19},"Anthropic",{"name":23,"type":19},"Google",{"name":25,"type":19},"Meta",{"name":27,"type":19},"Microsoft",{"name":29,"type":19},"SpaceX","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":30,"icon":32,"name":33,"slug":34},null,"GDPR","gdpr",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":52},{"id":53,"icon":32,"name":54,"slug":55},"f22671ea-092b-4568-aede-526bb16dedd5","EU AI Act","eu-ai-act",[],[23,27,18],{"controls":59,"vendors":60},[],[],{"slug":62,"title":63,"body":64,"framework_refs":65,"framework_notes":73},"eu-digital-expropriation-amendment-strips-gdpr-data-protections-for-ai-training","EU 'Digital Expropriation' Amendment Strips GDPR Data Protections for AI Training","The approval of GDPR Article 88bis represents a fundamental weakening of the regulatory framework that has historically protected EU citizens' personal data rights. By automatically permitting AI companies to process personal data without user consent, the amendment creates a systemic loophole that undermines the foundational principles of purpose limitation and data minimisation enshrined in GDPR. This matters because decades of personal data—collected under strict consent conditions—could now be repurposed for AI training without individual knowledge or recourse. The amendment demonstrates how legislative changes can erode data protection at scale, far more broadly than any single technical breach, and sets a dangerous precedent for corporate data exploitation under the guise of technological progress.",[66,67,68,69,70,71,72],"GDPR Article 32","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","CIS Control 14: Security Awareness and Skills Training","ISO\u002FIEC 27001:2022 Clause 7.2: Competence",{"GDPR Article 32":74,"NIS2 Article 21(2)(b)":75,"NIST SP 800-53 SI-2: Flaw Remediation":76,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":77,"CIS Control 14: Security Awareness and Skills Training":78,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":79,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":80},"Article 32 requires appropriate technical and organisational measures to protect personal data; the amendment directly bypasses this obligation by removing the consent and restriction requirements that Article 32 underpins, making compliance measures hollow without strong legislative backing.","NIS2 requires incident handling and risk management policies that account for legal and regulatory changes; organisations must treat legislative shifts like this amendment as a risk event requiring updated data handling procedures.","SI-2's principle of identifying and remediating flaws extends to policy and legal frameworks; the amendment introduces a systemic flaw in data protection that organisations must remediate through alternative technical controls like data minimisation and PETs.","Clause 7.2 requires organisations to ensure personnel have the competence to manage information security risks, including legal and regulatory risks to personal data that arise from amendments such as Article 88bis.","Staff and leadership must be trained to understand data protection regulations and the impact of legislative changes, so that organisations can respond quickly with compensating controls when regulatory safeguards are weakened.","While typically technical, this control's spirit of proactively identifying and managing risks applies here: organisations must monitor for 'legal vulnerabilities' such as regulatory amendments that expose personal data assets to new processing risks.","Ensuring that only authorised parties can access personal data is undermined when legislation grants blanket processing rights to AI companies, making internal access control frameworks insufficient without corresponding regulatory protections."]