STUDII ŞI CERCETĂRI Digital Omnibus: între promisiunea simplificării şi erodarea protecţiei datelor în Uniunea Europeană
STUDIES AND RESEARCH Digital Omnibus: between the promise of simplification and the erosion of data protection in the European Union

Summary/Abstract: This article critically analyses the Digital Omnibus package presented by the European Commission in November 2025, assessing the tension between the declared objective of simplifying compliance and the risk of weakening data protection standards in the European Union. It primarily examines the proposed amendments to the GDPR and the repositioning of the ePrivacy regime, with a focus on: the narrowing of the concept of „personal data” through the criterion of the controller’s „reasonable means”; the institutionalisation of mechanisms designed to adapt the GDPR to technological developments in pseudonymisation; the expanded reliance on legitimate interests for the training, testing, and validation of artificial intelligence systems; the flexibilisation of the regime governing data subject access requests (DSARs); and the broadening of exemptions from transparency obligations. In parallel, the article discusses the modernisation of cookie consent (through additional exceptions and machine readable consent signals), the harmonisation of incident reporting via a single entry point, and the proposed adjustments to the AI Act (including limited derogations concerning the use of sensitive data for bias mitigation and the reconfiguration of compliance timelines). As a first conclusion, we noticed that while the package may reduce compliance costs and regulatory fragmentation, certain reforms risk producing an asymmetric form of „simplification” that benefits controllers at the expense of substantive safeguards, thereby calling for stricter limitations and conditionalities in the legislative process to preserve the level of protection required by the European Union Charter of Fundamental Rights.

• Details
• Contents