Resources

Go back

Questioning the Council’s Position on Processors Under GDPR – 19/10/2026

What is the Council trying to achieve by making it harder for businesses to outsource data processing in ways that enhance privacy?

In the Digital Omnibus negotiations, Germany and Sweden, with Denmark’s support, have proposed that processors should remain subject to GDPR even where they cannot realistically identify the individuals whose data they process. The apparent lack of opposition in Council suggests the proposal may enjoy wider support.

But what is the rationale?

Businesses increasingly outsource data analytics and AI development to specialist providers, removing identifying information and minimising the processing of personal data in the process. These arrangements reduce costs, improve efficiency, and provide better protection for individuals.

Why would policymakers want to discourage this? What economic or privacy benefit would justify doing so? How does this support the free movement of personal data in the EU?

The proposal could even encourage businesses to use independent third parties rather than processors, potentially weakening accountability.

The EU’s 𝘖𝘯𝘦 𝘌𝘶𝘳𝘰𝘱𝘦, 𝘖𝘯𝘦 𝘔𝘢𝘳𝘬𝘦𝘵 𝘙𝘰𝘢𝘥𝘮𝘢𝘱 promises simplification, innovation and competitiveness. It is difficult to see how this proposal advances those objectives.

Europe cannot credibly promise to simplify regulation and strengthen competitiveness while introducing rules that may penalise businesses for reducing privacy risks. If the objective is to protect personal data, policymakers must explain why regulation for the sake of regulation should take precedence over encouraging processing arrangements that deliver better privacy outcomes.

19 October, 2026