Why the EU's GDPR and cookie reform still changes nothing for your website

One day, the text will affect every website and every IT manager in the Union. On October 21, representatives of the 27 member states settled the position of the Council of the European Union on the "data" part of the Digital Omnibus, the package of digital rules simplification proposed by the European Commission. It amends the GDPR (General Data Protection Regulation), the ePrivacy directive that governs cookies, and the way cybersecurity incidents are reported.

This is a negotiating position, not a law: nothing changes for companies today. Talks with the European Parliament will begin once it has adopted its own position, which it has not yet done.

The definition of personal data stays the same

The Commission wanted pseudonymized data to be able to escape the GDPR for a company that has no reasonable means of identifying the person concerned. The member states refused: the current definition is kept, supplemented by a provision on pseudonymization. The European Data Protection Supervisor, Wojciech Wiewiórowski, had warned that the initial proposal would "considerably reduce" the notion of personal data, according to the IAPP, the International Association of Privacy Professionals.

On artificial intelligence, the Council keeps the possibility of processing sensitive data for biometric verification and the development of AI systems, but adds safeguards and clarifies the legal bases for processing personal data. Unfounded or excessive access requests would be easier to handle, and information obligations would be lighter when the risk is low.

Cookies without consent in more cases

The Commission had moved the cookie rules into the GDPR. The Council leaves them in the ePrivacy directive but widens the cases where consent is not required: providing the requested service, audience measurement, device security. According to an analysis by the legal site NICFAB, the text sets a closed list of six purposes exempt from consent. It also drops the obligation for sites to honor consent choices set in the browser, and cuts from six to four months the delay before asking again for a consent that was refused.

Reporting an incident: one portal per country

This is the point that matters most to security teams. The Commission proposed a single entry point, at the European level, to report cybersecurity incidents and data breaches. The member states prefer a national entry point in each country, supplemented by a European information point and harmonized rules, particularly for incidents affecting several countries. The Council also backs a longer deadline for reporting a data breach. According to NICFAB, it adopts the Commission's proposal: 96 hours instead of 72, with a higher reporting threshold.

What to do in the meantime

Nothing new, other than continuing to apply the current rules:

• a data breach must still be reported to the CNIL (the French data protection authority) within 72 hours;
• non-essential cookies still require the user's consent;
• as for NIS2, whose French transposition is still awaited, this text changes nothing for now.

The compromise was not easy. According to NICFAB, the text, placed on the agenda on October 7 and 11, was not adopted: on the 7th, Germany and France demanded better protection of trade secrets in the Data Act, and on the 11th, it was not even discussed. The Irish presidency now wants a quick agreement: for Minister Helen McEntee, these changes are "an important step" for Europe's attractiveness. The next milestone is the European Parliament's position, without which no final negotiation can begin.