Share This Article
The European Commission’s latest Digital Omnibus package introduces a significant and much-debated idea: allowing AI training based on legitimate interest, under Article 6(1)(f) GDPR, accompanied by a new Article 88c. The proposal formalises something many expected — that training AI systems or AI models on personal data may rely on legitimate interest as a legal basis.
But the key question emerges immediately: is this enough?
And does the wording of the proposal offer the clarity that the European AI ecosystem needs?
At first sight, the Commission’s move appears to acknowledge practical needs. Innovation in AI, especially large language models and foundation models, depends on vast amounts of data. Given the tension between AI development and strict consent-based frameworks, the introduction of a dedicated legal pathway under legitimate interest seems both necessary and overdue.
Yet, when we examine the proposed wording closely, several uncertainties remain — and these uncertainties may determine whether the provision becomes a meaningful tool or a regulatory puzzle.
A clear step forward, but framed in cautious terms
The draft states that where the processing of personal data is necessary for the development or operation of an AI system or AI model, such processing “may be pursued for legitimate interests” under Article 6(1)(f) GDPR.
The choice of the word may is not neutral.
It does not create an unconditional presumption.
It does not replicate the clarity and simplicity of the ePrivacy Directive’s “soft opt-in,” which gives controllers a clean, objective exception.
Instead, it maintains the existing structure of legitimate interest assessments and leaves several determinations — necessity, proportionality, balancing of interests — to the controller and, ultimately, to data protection authorities.
In other words: this is not a safe harbour.
Conditions that may create new layers of interpretation
Article 88c introduces conditions that appear reasonable in principle — organisational and technical safeguards, minimisation, transparency, and non-disclosure of residually retained data.
However, the practical implementation of these requirements raises several challenges:
-
How detailed must minimisation be during dataset selection?
-
To what extent must controllers ensure “enhanced transparency” to data subjects, especially if training relies on publicly available content?
-
How should the “unconditional right to object” be operationalised for model training?
-
Where is the line between residual retention and functional necessity for model integrity?
Each of these questions invites interpretation. And interpretation invites fragmentation.
For companies developing or deploying AI systems at scale, the risk of divergent national assessments is real — and this undermines the very goal of harmonisation that the Digital Omnibus seeks to achieve.
Could the EU Commission have been braver?
The industry’s expectation was that the Digital Omnibus would go further.
Many hoped for a straightforward provision establishing that AI training is presumed to rely on legitimate interest, provided that safeguards are met — much like the ePrivacy soft opt-in.
A stronger presumption would have:
-
reduced DPAs’ discretion,
-
offered developers clearer legal certainty, and
-
prevented inconsistent interpretations across Member States.
Instead, the Commission opted for incrementalism rather than boldness.
Whether this choice reflects political caution, ongoing litigation, or a desire to preserve regulatory flexibility remains open to debate.
Impact on ongoing disputes between LLM providers and DPAs
A central question now is whether Article 88c, as drafted, will meaningfully affect ongoing disputes between LLM developers and European regulators.
On the one hand, it recognises legitimate interest as a viable legal basis for training — which several DPAs have challenged.
On the other hand, the safeguards and discretionary elements built into the provision give regulators wide room to scrutinise implementation.
This means that disputes may shift from “Is legitimate interest allowed?” to “Does your implementation satisfy the criteria?” — a more nuanced, but not necessarily easier, debate.
Final Considerations
The proposal for Digital Omnibus legitimate interest AI training is undeniably a step in the right direction. It offers a structured legal basis for a practice that is essential to the development of European AI capabilities.
But the provision is cautious.
It avoids clear presumption.
It preserves DPA discretion.
And it opens the door to interpretive variability.
Whether this is the best balance the EU could strike — or simply the most politically feasible option — remains an open question.
What is clear is that the conversation is only beginning.
On the same topic, you can read the article “AI Training Under Scrutiny by EU Privacy Authorities“.