On 10 February 2026, the European Data Protection Board and the European Data Protection Supervisor issued their second joint opinion of the year on the Digital Omnibus. While the first joint opinion (which we discussed here) focused on the implementation of harmonised rules on artificial intelligence and the proposed amendments to the AI Act, this second joint opinion focuses on the proposed changes to the GDPR and the EUDPR, the ePrivacy directive and, more in general, the Digital Aquis.
While the EDPB and the EDPS welcome the parts of the proposal that may foster greater harmonisation (such as those concerning scientific research, the new exception for the processing of special categories of data for biometric authentication, and the amendments relating to data breach notifications and data protection impact assessments), there are other parts of the proposal that raise concerns. In particular, the two bodies believe that the following changes might adversely affect the level of protection enjoyed by individuals, create legal uncertainty, and/or make the law more difficult to apply in practice. Namely:
The proposed changes to the definition of personal data, which the EDPB and the EDPS fear might narrow the concept of personal data and adversely affect the fundamental right to data protection.
The EDPB and the EDPS also believe that defining what is no longer personal data after pseudonymisation directly affects the scope of application of EU data protection law and should not be addressed in an implementing act.
There are other topics on which the two bodies support the Proposal’s objectives, but believe that improvements are necessary. These include:
the use of legitimate interest in the context of AI;
an exception for incidental and residual processing of special categories of data in the context of AI;
limitations to the right of access;
a new derogation from transparency obligations;
automated individual decision-making.
The joint opinion also addresses the changes that the Digital Omnibus proposes in relation to the ePrivacy Directive, and in the second part of the Joint Opinion, the EDPB and the EDPS address key changes introduced by the Proposal in the data legislative acquis (‘Data Acquis’).
To read the full opinion, click on the link.
