EU Council approves amendment to GDPR allowing unrestricted AI data processing

What happened

EU Member States, through the Council, approved a change to the GDPR that would make processing personal data "in the context of AI" automatically lawful. The amendment (Article 88bis) would let AI companies use any personal data without consent, relying on a broad legitimate interest. The proposal still requires negotiation with the European Parliament before becoming law.

Why it matters for trust and compliance

• Its status is announced. It is not law yet. Track it, but do not treat it as an obligation.
• The amendment could override fundamental privacy rights by permitting AI firms to use all personal data with minimal safeguards.
• It relates to GDPR. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Check that privacy notices describe the practices this addresses.
3. Revisit retention schedules and data minimisation for the data involved.
4. Inventory AI or automated decision systems in scope and their assessments.