EU 'Digital Expropriation' Amendment Strips GDPR Data Protections for AI Training
The approval of GDPR Article 88bis represents a fundamental weakening of the regulatory framework that has historically protected EU citizens' personal data rights. By automatically permitting AI companies to process personal data without user consent, the amendment creates a systemic loophole that undermines the foundational principles of purpose limitation and data minimisation enshrined in GDPR. This matters because decades of personal data—collected under strict consent conditions—could now be repurposed for AI training without individual knowledge or recourse. The amendment demonstrates how legislative changes can erode data protection at scale, far more broadly than any single technical breach, and sets a dangerous precedent for corporate data exploitation under the guise of technological progress.
Tactical Insight
Immediate organisational actions
- Conduct a full audit of all personal data held by your organisation to understand exposure if similar legislative changes affect your jurisdiction.
- Review and update data processing agreements and privacy notices to reflect any new legal bases introduced by regulatory changes.
Long-term data governance improvements
- Implement data minimisation practices so that only the minimum necessary personal data is retained, reducing exposure when laws change.
- Establish a cross-functional privacy and legal team to monitor legislative developments (such as GDPR amendments) and rapidly assess organisational impact.
- Invest in Privacy-Enhancing Technologies (PETs) such as differential privacy or federated learning to enable AI development without requiring identifiable personal data.
Advocacy and monitoring measures
- Subscribe to regulatory monitoring services (e.g., IAPP, noyb alerts) to receive early warning of legislative changes that affect data protection obligations.
- Engage with industry and civil society groups to advocate for strong data protection standards and participate in public consultations on proposed amendments.