Introduction 

The European Union’s effort to simplify its digital rulebook has opened a wider debate about the future of personal data in the age of artificial intelligence. On 21 October 2026, the Council of the European Union negotiated it's position on the Digital Omnibus, including proposed amendments to the General Data Protection Regulation (GDPR) concerning the development and operation of AI systems. 

The council’s approach was later described as a form of “digital expropriation”, arguing that the amendments could allow companies with large stores of personal data to reuse that information for AI development on substantially broader terms. Since the GDPR does not treat personal data as property owned by individuals, and the proposal does not formally transfer ownership of anyone’s information to AI companies. The controversy instead concerns control. Whether data collected in one context can increasingly be repurposed for AI development without fresh consent, and whether the GDPR’s existing safeguards are strong enough to constrain that reuse. 

What Does “Digital Expropriation” Mean? 

Expropriation traditionally describes the compulsory taking of property. That concept does not map neatly onto European data-protection law. Article 8 of the Charter of Fundamental Rights of the European Union recognises protection of personal data as a fundamental right. The GDPR gives individuals rights of access, rectification, erasure, objection and portability, while imposing restrictions on how controllers may collect and use their information. It does not create a conventional property right in personal data. The phrase “digital expropriation” is better understood as a criticism of diminished control over the economic and technological use of personal information. 

That concern becomes particularly relevant for AI. Companies may already possess years of search histories, social-media activity, communications, photographs, browsing behaviour or other information collected for existing services. If that information can later support AI development under a broad legitimate-interest analysis, it's economic value can be redirected towards a purpose that users may never have contemplated when the information was originally collected. 

What is the Council Proposing? 

The council mandate introduces a new Article 88bis, dealing specifically with processing in the development and operation of AI systems and models. 

The provision states that such processing may be carried out based on legitimate interests under Article 6(1)(f) of the GDPR, where appropriate. The controller's interests must still be balanced against the interests, rights and freedoms of the data subject, particularly where children are involved. Other EU or national laws that expressly require consent would continue to apply. 

The council text does not say that every use of personal data for AI automatically becomes lawful. The purpose must be assessed case by case. Controllers also remain subject to appropriate technical and organisational safeguards and the GDPR right to object. This places some distance between the language of the legal text and the strongest version of the “digital expropriation” criticism. 

Why Are Privacy Advocates Concerned? 

The concern comes from the practical effect of creating an AI-specific provision within the GDPR. Article 6(1)(f) already permits processing based on legitimate interests. The Court of Justice of the European Union has consistently treated this as requiring three elements: a legitimate interest, necessity of the processing, and a balancing exercise in which the data subject’s rights do not override the controller’s interest. 

The EDPB’s Opinion 28/2024 on AI models similarly concluded that legitimate interest may support some AI development and deployment, but only after a fact-specific assessment. Factors such as the source of the information, its original context, individuals’ reasonable expectations and the impact of processing remain relevant. 

The EDPB and EDPS have consequently questioned whether a dedicated AI provision is needed at all. In their Joint Opinion on the Digital Omnibus, they noted that the GDPR already allows legitimate interest to operate in the AI context where its existing requirements are satisfied. Critics fear that expressly naming AI in the GDPR could gradually influence how controllers, regulators and courts approach the balancing exercise. A possibility already available under Article 6 could begin to look more like a regulatory preference for AI-related reuse. 

The Problem of Repurposing Existing Data 

Purpose limitation sits at the centre of this debate. Under Article 5 of the GDPR, personal data must be collected for specified, explicit and legitimate purposes and should not subsequently be used in an incompatible manner. This protection matters when information collected long before the current AI boom becomes technically useful for model development. 

Consider a platform that has accumulated years of user posts, photographs or interactions. The fact that these records are readily available to the company does not answer whether using them to train a new AI model is compatible with the purpose for which they were originally collected. 

Public availability does not resolve the issue either. The EDPB's 2026 guidance on web scraping stresses that personal information being publicly accessible does not remove GDPR requirements. Legitimate interest still requires necessity and balancing, while reasonable expectations remain relevant. 

An AI-specific lawful-basis provision could create greater legal certainty for companies. Its application must still preserve meaningful scrutiny of why the information was collected, what users were told and whether subsequent AI processing materially changes the relationship between the controller and the individual. 

What About Sensitive Personal Data? 

The Digital Omnibus also proposes a separate change concerning special categories of personal data, such as health information, political opinions, religious beliefs and information concerning racial or ethnic origin. The council text would allow a limited derogation where such information appears incidentally and residually in datasets used for AI development or technical operation. 

Several safeguards apply. Controllers must implement measures aimed at preventing the processing of sensitive information. When such data is identified, it should be erased without undue delay. If deletion is technically impossible or would require manifestly disproportionate effort, the information must be protected against further processing, disclosure or use to generate outputs. 

This is narrower than a general authorisation to train AI on sensitive data. Deliberate processing of special-category information remains subject to the ordinary requirements of Article 9. The provision still deserves close attention because large AI datasets make incidental collection particularly difficult to control. The legal standard will depend heavily on what regulators consider adequate filtering, monitoring and deletion efforts. 

Does the Right to Object Provide Enough Protection? 

The council text expressly preserves the right to object enshrined in Article 21 of the GDPR. For processing based on legitimate interests, individuals can object on grounds relating to their situation. The controller must then stop processing unless it demonstrates compelling legitimate grounds that override the individual’s interests, rights and freedoms, or requires the information for legal claims. 

This is weaker than an unconditional opt-out. An objection mechanism may exist formally while remaining difficult to exercise effectively if individuals do not know that their historical information is being used, cannot identify which model contains it or face technical limits on removing information after training. Transparency and privacy engineering consequently become central to whether Article 21 offers practical control. 

Could the Rules Favour Data-Rich Companies? 

The economic dimension gives the “digital expropriation” argument much of its force. Large technology companies already possess enormous quantities of first-party data accumulated through established platforms and services. Smaller AI developers may not have comparable datasets. A rule that makes reuse of existing personal data easier could strengthen the value of those historical data holdings. This may benefit companies whose market position already gives them access to information at a scale that new entrants cannot reproduce. 

The outcome is not necessarily greater European AI competitiveness. Legal certainty could support European developers and lower compliance costs, but any competitive advantage created by easier data reuse may disproportionately accrue to organisations that already control the largest datasets. 

Data-protection policy and competition policy increasingly intersect at this point. Personal data is simultaneously protected information and a major economic input into digital services and AI development. 

What Should Organisations Do? 

Organisations should not treat the council mandate as a blanket authorisation for AI training. The proposal remains under negotiation and existing GDPR obligations continue to apply. 

Businesses considering legitimate interest for AI-related processing should: 

• Define the actual purpose: “AI development” alone should not substitute for a specific and legitimate objective. 

  
  

• Conduct a documented balancing assessment: Evaluate necessity, reasonable expectations, scale of processing and possible effects on individuals. 

  
  

• Review historical datasets: Determine whether existing information can lawfully be repurposed and whether earlier privacy notices remain adequate. 

  
  

• Minimise training data: Access to large datasets does not establish that every available category of personal data is necessary. 

  
  

• Build effective objection mechanisms: Individuals should have a realistic way to understand and challenge the use of their information.

  
  

• Separate incidental sensitive data from intentional processing: Article 9 safeguards remain particularly strict where special-category information is deliberately used. 

Conclusion 

“Digital expropriation” is not a legal description of the Digital Omnibus. It captures a genuine policy concern about who benefits when vast stores of personal information acquire new value as AI training material. 

The council text retains the GDPR's legitimate-interest balancing test and expressly states that AI development does not automatically qualify as a legitimate interest. These safeguards make claims of unrestricted AI access to Europeans’ data too broad. The harder issue lies in practice. An AI-specific provision could make reuse of personal data easier to justify, particularly for companies that already hold extensive datasets. Its impact will depend on how strictly necessity, purpose limitation, reasonable expectations, transparency and the right to object are applied. 

The debate surrounding “digital expropriation” ultimately reflects a broader tension in European digital policy: encouraging access to the data needed for AI development while preserving the individual control that has long formed part of the GDPR’s regulatory model. 

Want to Stay Ahead? 
Reach out to the experts at GoTrust today.