Data Omnibus: Will AI training get a blanket 'legitimate interest' pass?

After the summer parliamentary break, the debate over the Data Omnibus has returned. The EU package aims to simplify and partially loosen data rules. As netzpolitik.org notes, the focus has shifted to one proposal: using personal data to train AI systems should in principle be considered lawful under 'legitimate interest'.

The trigger is a compromise document from the Irish Council presidency dated 3 September 2026, whose contents were revealed by Politico. The note revives an idea the European Commission included in its original Data Omnibus draft. It was struck out in the first half of the year at the request of the Cypriot presidency. According to leaks, large member states, including Germany, backed the solution, arguing it would help European AI companies.

The wording would mean model providers no longer need explicit and informed consent from users. Nor would they need a case-by-case balancing test. A general presumed legal basis would suffice.

'Digital expropriation'

Max Schrems, head of the group noyb, is critical of the proposal. He argues it places the interests of AI corporations directly above the fundamental right to data protection, calling it a 'digital expropriation of Europeans'. His point is that such a rule would primarily benefit the largest technology companies, which have already collected data on a massive scale.

Training models on data scraped from the web is not necessarily at odds with the GDPR. The European Data Protection Board has acknowledged that legal bases other than consent exist, such as a balancing of interests. However, lawyers disagree on whether that balancing always favors companies. One issue is the lack of transparency. Users do not know exactly what happens to their data or where it resurfaces.

What else the package contains

The Data Omnibus is part of a broader deregulation agenda. Reporting duties in the environmental field were cut earlier, and some AI rules were softened. The data package is the first to change the GDPR in depth. Beyond the disputed legal basis for training, it includes less controversial elements: tidying up several EU data laws and standardising the channels for reporting data protection breaches.

The institutional context shows how much is at stake. The European Commission runs an AI Office with more than 125 staff, organised into six units. They handle applying the AI Act and enforcing rules on general-purpose models. The office can carry out model evaluations, demand information, and impose penalties. For companies, the question of the legal basis for training is therefore a question of whether their data can be used at all, and whether they did so under rules that, as is clear, keep changing.