Brussels, 24 March 2026 – DOT Europe, the voice of the leading internet companies in Europe,
presented a legal assessment on Article 9 of the GDPR (processing special categories of personal
data) under the Digital Omnibus.
The Digital Omnibus represents an opportunity to strengthen Europe’s competitiveness in the
global digital economy, particularly on AI. Providing clear, workable rules for data use is essential if
AI is to be developed and deployed at scale in Europe. Without such clarity, there is a real risk that
innovation and investment will migrate to jurisdictions with more predictable regulatory
environments.
“We welcome the derogation enabling residual processing of special categories of data to train AI
models,” said Benjamin Brake, Director General at DOT Europe. “However, the Digital Omnibus does
not properly address two central issues: training AI models is impossible without including personal
data of public figures, and the full deletion of special categories of data after collection is not always
technically feasible.”
The legal assessment argues that, when appropriately applying existing CJEU case law, the GDPR
can already address the issues the proposed amendments seek to address. As currently drafted, the
Digital Omnibus’s amendments do not resolve the legal uncertainty around the lawfulness of
processing special categories of data and criminal data of public persons — both essential for
training AI models.
DOT Europe also finds that the current amendment is unnecessarily strict in prescribing a fixed
sequence of safeguards. “Requiring controllers to avoid collecting sensitive data upfront is not
realistic as it would effectively mean pre-scrubbing the entire internet,” said Andrea Montarolo,
Policy Manager at DOT Europe. “Instead, safeguards should focus on continuous, lifecycle-based risk
mitigation, in line with the AI Act”.
To deliver on its ambitions, the Omnibus should not only simplify existing rules but also ensure they
are technically feasible and innovation friendly. A more proportionate, risk-based approach would
better support the development of trustworthy AI while upholding Europe’s high standards of data
protection.
ENDS
For more information from DOT Europe contact:
+32(0) 472 26 83 02
info@doteurope.eu
