The Council of the European Union has agreed a negotiating position on a package intended to simplify parts of the bloc’s data-protection, privacy, data and cybersecurity rules. The mandate is not final law: talks with the European Parliament can begin once Parliament adopts its own position.
The proposal belongs to the EU’s Omnibus VII simplification package. Council officials say the goal is to reduce administrative friction for companies and public bodies while retaining protections for personal data and fundamental rights.
GDPR and research provisions
The Council mandate keeps the existing definition of personal data but adds clarification on pseudonymisation and when a person can be identified. It also proposes simpler handling of unfounded or excessive requests and certain low-risk information duties.
For scientific research, the text supports a principle-based definition and targeted exemptions intended to make data processing more consistent. It also adds safeguards around a proposed route for processing sensitive data for biometric verification and the development or operation of artificial-intelligence systems.
The mandate backs an extension of the deadline for notifying personal-data breaches and proposes common EU templates and a single EU-level list of processing activities likely to create high risks for individuals. The details remain subject to negotiation with Parliament.
Cookies, data rules and incident reporting
On cookies, the Council would keep the e-privacy framework but clarify more situations in which consent is not required. Its examples include cookies needed to provide a requested service, measure audiences or secure a user’s device. The stated aim is to reduce repetitive banners without removing the underlying tracking rules.
The package would also consolidate rules on data altruism and data intermediaries, allow different conditions for some public-sector data reuse by very large companies and strengthen safeguards against trade-secret disclosure to third countries.
For cyber and data incidents, the Council moved away from one EU-wide intake point. It instead proposes a national entry point in every member state, supported by an EU information point and a more harmonized approach to cross-border notification.
The mandate covers several legal systems at once, including GDPR, the e-privacy directive and the EU’s broader data rulebook. Businesses should therefore treat the announcement as the start of an institutional negotiation, not as an immediate compliance change. Existing obligations remain in force unless and until amendments are formally adopted and take effect.
Source: Council of the EU press release and mandate summary.
Disclosure: The featured image is an AI-generated editorial illustration.
