EU Plan to Gut GDPR Protections for Big Tech

The EU Commission has unveiled its "Digital Omnibus" proposal, a sweeping reform that civil society groups and privacy advocates are calling a massive attack on core GDPR principles. Despite strong opposition from the European Parliament and most member states, the Commission is pushing through changes that effectively lower data protection standards to favor large US technology companies. For Swedish CTOs and CISOs, this signals a potential shift where compliance becomes less about protecting individuals and more about navigating new loopholes designed for big tech.

The proposal fundamentally alters how "personal data" is defined by introducing a subjective approach rather than an objective one. Under the current rules, data linked to an identifiable person is protected; the new draft suggests that if a company claims it does not intend to identify a user, the GDPR might not apply. This creates a legal gray area where the applicability of privacy laws depends on a company's internal mindset, making enforcement nearly impossible. Furthermore, the plan explicitly opens the door for using vast amounts of personal data from social media profiles to train AI models, relying on an opt-out mechanism that advocates argue is practically unworkable for users.

For Swedish organizations, the risks are immediate and concrete. The proposed changes could create significant compliance gaps where companies assume they are exempt from GDPR obligations simply because they classify data as "pseudonymized" or claim a lack of intent to identify users. This ambiguity invites legal uncertainty and increases the risk of fines if regulators later determine that the subjective definition does not hold up in court. Additionally, limiting user rights to strictly "data protection purposes" could expose employers and platforms to litigation when they reject access requests related to labor disputes or credit checks, potentially violating established case law from the Court of Justice of the European Union.

This regulatory drift reinforces a critical strategic imperative for Swedish technology leaders: the need to process sensitive data locally within the EU or Sweden whenever possible. By relying on external APIs that operate under these loosened standards, companies risk having their data absorbed into opaque training datasets with little recourse. Maintaining strict control over data sovereignty through local processing ensures that organizations remain subject to the robust protections of the current GDPR framework rather than being swept up in a regulatory environment designed for global scale at the expense of individual rights. The safest path forward is not to wait for legal clarification on these new loopholes, but to architect systems where data never leaves a trusted jurisdiction.