EU considers GDPR changes

The 2025 EU Commission work programme has a stronger focus on simplification than ever before. The EU is stress-testing legislation with the aim of suggesting concrete simplification measures. For the digital field, we expect to see proposals in the EU Data Union Strategy, to be issued in the third quarter of 2025.

The EU’s aim for a simplified, coherent legal framework can be seen against pressures from the US, but also a realisation that the digital package is wide and complex, and difficult for both organisations and regulators to cope with. In my interview with Belgium’s Data Protection Authority’s Chairman, Hielke Hijmans, he identified the relationship between the EU AI Act and the GDPR as particularly challenging. So far, proposals on reduced GDPR record-keeping duties would benefit smaller organisations, something that Malta’s Information and Data Protection Commissioner Ian Deguara warmly welcomes.

As for the GDPR, German MEP Alex Voss has proposed a three-tier system; A “Mini-GDPR”' layer which would cover 90% of businesses, with less documentation and simplified transparency, a “Normal GDPR” layer, maintaining most of the existing rules, and a “GDPR-plus” for organisations whose business model relies on the processing of personal data.

On AI, the EU recently issued its AI continent action plan, geared towards making the EU the global AI leader. In addition to increased investment and training, the aim is also to improve access to high-quality data. While large, high-quality datasets are essential to develop and train advanced AI models, DPAs should set parameters for the use of personal data. Recently, Meta announced that it has started training its AI model on Instagram and Facebook user data.

Whilst there is an ever-increasing workload for DPOs, there is also more information and guidance available. For example, the Court of Justice of the European Union (CJEU) has now issued a very helpful matrix on the case-law on the protection of personal data. “The aim of this factsheet is to present a selection of seminal rulings on the subject and rulings that have made a significant contribution to the development of this case-law, with particular emphasis on rulings handed down by the Grand Chamber of the Court,” the CJEU says.(1)

Laura Linkomies
Editor, Privacy Laws & Business

June 2025