EU AI Deal: Privacy Laws Yield to Big Tech Profits

Overview

A leaked draft from the Irish Presidency of the Council of the European Union has ignited a fierce controversy regarding the future of digital privacy in Europe. The proposal suggests that the commercial interests of major artificial intelligence corporations should take precedence over the fundamental right to data protection. Under this plan, the use of personal data "in the context of AI" would be automatically deemed lawful, effectively removing the need for user consent in many scenarios.

The document reveals that there appears to be wide informal agreement among many EU Member States to support this shift. If adopted, the regulations would allow Big Tech companies to utilize all personal data collected over the past decades with virtually no restrictions. This includes data from social media interactions, chats, and other digital footprints, provided it is used for AI training or operations.

Critics, including prominent data protection lawyer Max Schrems, have described the move as a "digital expropriation" of Europeans. They argue that the legislation prioritizes the profits of companies like OpenAI, Anthropic, Google, Meta, and SpaceX over the privacy rights of EU citizens. The controversy centers on Article 88bis (formerly Article 88c) of the proposed "Digital Omnibus" package, which aims to streamline EU tech laws but has been criticized for bypassing essential fundamental rights assessments.

The Scope of Data Expropriation

The core of the controversy lies in the proposed liberalization of how personal data can be processed. Currently, the General Data Protection Regulation (GDPR) requires that data processing be limited to specific, explicit purposes. However, the new proposal intends to legitimize the use of an entire technology category—artificial intelligence—regardless of the specific purpose.

Under the current rules, companies must generally obtain consent or demonstrate a legitimate interest that overrides individual rights on a case-by-case basis. The Irish Presidency’s draft, supported by Germany and other member states, suggests that any entity using AI can automatically assume an overriding legitimate interest. This means companies would not need to ask users for permission to use their data for AI training or commercial applications.

This blanket allowance would apply even to individuals who have never interacted with a specific AI company. Furthermore, it would cover data collected decades ago. Any personal data that an AI corporation can access would fall under this provision, effectively making all historical digital records fair game for corporate use.

"A likely majority of EU member states are now saying that the interests of Elon Musk, Marc Zuckerberg, Google or Open AI, in making enormous profits, should take precedence over European’s fundamental right to data protection. This is nothing short of the ‘digital expropriation’ of Europeans." — Max Schrems

Schrems argues that this legislative change represents a complete sell-off of European data to global corporations. He notes that most EU-based companies lack the vast repositories of data and the capital required to compete with US tech giants. Consequently, the data collected by European firms, often processed on US platforms, could flow freely to providers in the United States and China.

Industrial Policy and Economic Concerns

Proponents of the Digital Omnibus, including the European Commission, have claimed that the changes are merely minor simplifications intended to maintain a high level of protection for Europeans. To facilitate this, a "fast-track procedure" was chosen, avoiding the involvement of the European expert group on data protection and skipping a formal fundamental rights assessment.

However, critics warn that the economic rationale behind this approach is flawed. By abolishing strict data protection laws, the EU may inadvertently hand a competitive advantage to non-European corporations. The removal of barriers allows companies with existing massive datasets to dominate the market, while smaller European innovators are left without the resources to compete.

From an industrial policy perspective, Schrems describes the move as "madness." He points out that the legislation primarily benefits those who have already amassed enormous amounts of European personal data. This could result in a significant outflow of know-how and intellectual property from EU companies to the US or China, undermining the European digital economy rather than strengthening it.

The proposal also raises questions about the long-term viability of the European data protection framework, which has been in place since 1981. For decades, Europeans were promised that strict data laws would ensure platforms and corporations never used their information for purposes other than what was originally shared. This proposal breaks that promise, signaling a fundamental shift in how the EU views the value of privacy versus commercial interest.

Risks and Ethical Implications

Beyond the economic and legal arguments, there are serious concerns about the ethical implications of granting such broad powers to AI companies. The proposed Article 88bis would permit processing operations that are currently illegal, solely because they are conducted within the context of an AI system.

This includes activities such as creating deepfakes, generating non-consensual nude images, spreading disinformation, or developing autonomous weapons systems. Currently, processing personal data for targeted advertising without consent is prohibited. Under the new proposal, if such advertising is personalized using AI technology, it would suddenly become legal.

Schrems characterizes this as giving a "blank check" to a specific technology. He argues that it is absurd to give preferential treatment to a high-risk technology over every other computer system. The logic implies that any action is permissible if it is justified by the use of AI, regardless of the potential harm to individuals or society.

This shift marks the collapse of a 45-year commitment to data protection in Europe. The legislation that once ensured that data collected by giants like Facebook, Google, and Microsoft would be used only for stated purposes is now being eroded. As the Council considers the proposal, the debate continues over whether Europe will protect its citizens' digital rights or succumb to the commercial pressures of the global AI race.