Member states' permanent representatives (Coreper) agreed the Council's negotiating mandate on the Digital Omnibus on 21 October. The text simplifies rules in the GDPR, the ePrivacy directive and the Data Act, keeps the definition of personal data, adds rules on pseudonymisation and extends breach notification deadlines. Cookie rules remain, with more exemptions from consent. For cyber incident reporting, each member state will have a national entry point and ENISA an information point, and talks with Parliament will start once it adopts its own position.

What it means: The Council mandate is the first of two steps needed before trilogue negotiations, so the rules do not change yet. It does show where governments are heading: keeping core data protection while reducing red tape for businesses. Longer deadlines for notifying data breaches and clearer rules on pseudonymisation matter in practice for any company processing customer data. On cookies, more exemptions from consent could reduce banners on websites for uses such as basic audience measurement. On cybersecurity, the Council rejected a single European incident reporting point and prefers national portals, with ENISA directing businesses to the right authority. For Greek businesses already adapting to NIS2 and DORA, this means reporting will continue to go through Greek bodies. Until a final agreement, current obligations apply, so compliance procedures should not be relaxed. Parliament's position, which may be stricter on cookies and on the use of personal data for training AI systems, is worth following closely, as the final text will be a compromise between the two institutions.

Read the original on Συμβούλιο της ΕΕ

Related service: myDATA integrations

Related stories