EDPB and EDPS publish joint opinion opposing Digital Omnibus personal data changes
The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) have published a joint opinion opposing key aspects of the European Commission's Digital Omnibus proposal, which aims to simplify EU digital legislation including the General Data Protection Regulation (Regulation (EU) 2016/679 (GDPR)). The regulators strongly urge co-legislators not to adopt proposed changes to the definition of personal data, stating these would significantly narrow the concept and go beyond Court of Justice of the European Union jurisprudence. They also oppose empowering the Commission to determine through implementing acts what constitutes personal data after pseudonymisation. The opinion, adopted on 10 February 2026, supports certain proposals including increased data breach notification thresholds from likely risk to high risk, extended notification deadlines from 72 to 96 hours, and new biometric authentication exceptions where verification means remain under individual control. The regulators welcome ePrivacy Directive changes addressing consent fatigue and cookie banner proliferation but raise concerns about separate regimes for personal and non-personal data. The opinion also addresses artificial intelligence provisions, automated decision-making rules, and integration of the Data Governance Act into the Data Act.