🚨 hashtag#UPDATE: We worked a lot the last days (and over the weekend) to do a probably 90+% accurate analysis of DG CONNECT's (so Henna Virkkunen) draft of a hashtag#GDPR reform (aka the hashtag#DigitalOmnibus). We feel that the context and analysis in hashtag#Version2 of this overview may be useful - and make this all more readable for people.. 😉

We (noyb.eu) had our phone buzzing for two weeks now now by people in the Brussels institutions that are shocked - and then got the document a couple of days ago. We had our legal team go through it the last days, check CJEU case law and alike.

You can find Version 2.0 of our overview below, to maybe see how extreme and far reaching these changes are. We will update this and provide more input the next week (did not sleep much the last days).

My personal view:
➡️ (1) Whoever has drafted this had "tunnel vision" on the (alleged) "AI race" and has simply "bulldozed" the GDPR in many ways that will harm people in hundreds of other areas (minorities, online tracking, people suffering from health issues and alike)
➡️ (2) The quality of this draft is sooooo bad, that it does not even achieve the alleged aims for SMEs, AI or for "legal certainty". You would still run into a bunch of problems with AI training that apparently were not even on their radar (data minimization, purpose limitation, balancing test). More uncertainty is created. Finally, SMEs have almost no benefit from these changes (the "paperwork" problem is not at all solved).
➡️ (3) Many changes may either have a good chance to "clash" with Article 8 of the Charter or are outright legislating against CJEU case law on elements that are also in Article 8(2) CFR, so 99% you get this overturned by the CJEU. Some even clash with (good old) Convention 108. All another source of uncertainty for years to come and anything but "clarification", but a clear "pushback".
➡️ (4) The original plan (until two days ago) was to do the "Digital Fitness Check" in 2026 and then do a well-drafted, proper and evidence-based improvement to the GDPR. This "fast track" procedure (where people in the EU Services have 5 working days to review this draft) is not anything European business or people can work with…