The Council of the European Union has agreed on its negotiating position for a proposed package that would change parts of the EU’s digital rulebook. The decision, announced on October 21, covers data protection, online privacy and cybersecurity reporting. It is an important step in the legislative process, but it is not a new law: the Council’s text is the position of EU member-state governments for future talks.
The Digital Omnibus proposal covers several connected rules. It would amend parts of the General Data Protection Regulation, update some cookie provisions in the ePrivacy framework, consolidate certain EU data rules and create a more coordinated approach to reporting cyber incidents. The Council’s stated aim is to make requirements easier to apply while maintaining strong protection for personal data and citizens’ rights.
One key point in the Council’s position is that it keeps the GDPR’s current definition of personal data. It also proposes clearer provisions on pseudonymised information and selected compliance duties. On cookies, the Council supports keeping the existing framework while allowing specific uses, such as providing a requested service, audience measurement or device security, without a consent prompt. These are proposals in a negotiating text, not changes websites should treat as active rules today.
The Council also differs from the Commission’s original plan for cyber-incident reporting. Instead of one entry point at EU level, its position proposes a national reporting entry point in each member state, alongside an EU information point and a more harmonised framework for notifications. The goal is to make reporting less fragmented, although companies would still need to follow the rules that apply to them until any final legislation is adopted and takes effect.
The next major step is for the European Parliament to agree its own negotiating position. The Council presidency can then begin talks with Parliament, where the text may change before any final agreement. The Council has not announced an application date for this proposal. For businesses and technology users, the practical takeaway is simple: follow the current rules for now and watch the negotiations, rather than assuming the proposed changes are already in force.
Sources: