EU council approves article 88bis letting AI firms process data without consent

What happened

• The Council of the European Union adopted article 88bis as part of the Digital Omnibus package.
• The new provision treats processing of personal data “in the context of AI” as automatically lawful.
• It replaces the consent requirement with a presumed legitimate interest for AI companies.
• Minimal safeguards are retained, limited to references to existing GDPR rights.

Why it matters

AI developers and any organisation that trains or deploys AI models must assume a lawful basis for using all personal data, even historic data, unless they can demonstrate a specific opt‑out under Article 21. Controllers should reassess their data‑processing inventories and document the presumed legitimate interest.

Business impact

Businesses will face heightened scrutiny from data‑protection authorities and may need to redesign AI pipelines to incorporate opt‑out mechanisms and robust technical safeguards.

What to check

1. 1

   review AI data processingHigh priority

   Map all personal data used for AI training and assess whether the new automatic lawful basis applies.

2. 2

   document legitimate interestMedium priority

   Prepare a legitimate‑interest assessment for each AI use case as required by the new article.

3. 3

   implement opt‑out mechanismsMedium priority

   Provide clear opt‑out options in line with GDPR Article 21 for individuals whose data may be used.

4. 4

   enhance technical safeguardsHigh priority

   Adopt technical and organisational measures required by GDPR Article 24 to protect data used in AI.