REDEFINING ‘PERSONAL DATA’ IN THE DIGITAL OMNIBUS PROPOSAL: IMPLICATIONS FOR AI PROCESSING BY EU INSTITUTIONS UNDER REGULATION (EU) 2018/1725
REDEFINING ‘PERSONAL DATA’ IN THE DIGITAL OMNIBUS PROPOSAL: IMPLICATIONS FOR AI PROCESSING BY EU INSTITUTIONS UNDER REGULATION (EU) 2018/1725

Summary/Abstract: Published on 19 November 2025, COM(2025) 837 final proposes amendments to both the GDPR and Regulation (EU) 2018/1725 within the broader Digital Omnibus simplification package. This paper examines one of the proposal’s most consequential moves, namely the attempt to codify a relative, entity-specific approach to identifiability within the definition of personal data. Its central claim is that the proposed alignment between the GDPR and the EUDPR cannot be assessed only as a drafting exercise. Once projected onto the institutional framework of the Union, the amendment raises specific questions that the proposal does not sufficiently address, especially in relation to the supervisory role of the European Data Protection Supervisor, inter-institutional data environments, and AI-related processing involving pseudonymised and potentially sensitive datasets. Methodologically, the paper combines doctrinal analysis of the proposed legislative text with close reading of the Court of Justice’s judgment in EDPS v Single Resolution Board, the earlier line of case law from Breyer and OC v Commission, and Joint Opinion 2/2026 of the EDPB and EDPS. The article argues that the proposal appears to move beyond clarification and risks materially reshaping the scope of EU data protection law in the institutional context. It concludes that legislative parallelism between the GDPR and the EUDPR remains desirable, but only if accompanied by safeguards tailored to EU institutions.

• Details
• Contents