EU Poised to Ease AI and Data Rules — Critics Warn of Major Privacy Rollback

The European Union is preparing to propose a package of changes next week that would pause parts of its AI regulation and overhaul elements of its data-protection framework in an effort to ease compliance burdens on industry.

What’s proposed

According to EU officials and draft documents seen by reporters, the European Commission plans to announce measures around Nov. 19 that include:

• a one-year pause on implementing certain provisions of the bloc’s AI Act, notably some obligations for so-called high-risk systems;
• a substantial revision of GDPR-related rules aimed at simplifying how companies can access and process user data to train AI models, including proposals to narrow what counts as personal data and to allow processing under a legitimate interest basis.

Why the change

The Commission frames the moves as a "simplification" exercise intended to cut administrative red tape and help European firms compete with large US and Chinese technology competitors. Brussels says the adjustments are technical and designed to streamline compliance rather than weaken protections.

Reaction and concerns

The leaked proposals drew rapid and strong criticism from privacy advocates and civil-society groups. A coalition of 127 organisations warned the plan could become "the biggest rollback of digital fundamental rights in EU history." Privacy campaigner Max Schrems and his group Noyb described the revisions as a major downgrade of European privacy safeguards if implemented as drafted.

"I can confirm 100 percent that the objective... is not to lower the high privacy standards we have for our citizens," said Thomas Regnier, the EU spokesman for digital affairs.

Political hurdles ahead

Any changes will require approval by both the European Parliament and member states, and the proposals have already prompted a partisan response: some conservatives and centrist allies have voiced alarm, socialists oppose delays to the AI law, and other groups insist they will resist any measures that reduce privacy protections.

Context

The AI Act was designed to regulate systems that pose risks to safety, health or fundamental rights, while the GDPR — enacted in 2018 — has been the global benchmark for data protection. The current package follows heavy lobbying from large European companies and US tech firms, and comes after calls from industry and some policymakers to ease rules seen as hindering AI development.

The Commission says the final proposals could still change before the official announcement. Critics warn that even technical-sounding changes may have far-reaching consequences for privacy, while supporters argue simplification is necessary to foster innovation.