The Digital Omnibus: Deregulation Dressed as Innovation

The EU's sweeping data and AI package loosens safeguards for workers while promising competitiveness gains that will flow mainly to US tech giants.

https://www.socialeurope.eu/the-digital-omnibus-deregulation-dressed-as-innovation



The Digital Omnibus Package recasts EU data and artificial-intelligence law as a tool for AI competitiveness. Presented as a neutral technical simplification to unlock the power of data, it is in practice a deregulatory exercise that will sideline social and labour objectives and weaken protections for workers. The package restructures the EU data acquis by consolidating instruments into a single Data Act and loosening safeguards in the General Data Protection Regulation (GDPR), the AI Act and related laws, while launching an EU Data Union Strategy. Its evidential base is thin, with no substantiated impact assessment or risk analysis. As Mariniello, Alemanno and NOYB rightly argue, the Digital Omnibus represents a constitutional shift. Yet this shift has been introduced without systematic assessment of its consequences for workers and other vulnerable users.

Workers bear the burden

The Digital Omnibus is a horizontal regulation, many of the amendments it introduces to existing legislation will directly have an impact on workplaces that use AI-assisted monitoring and algorithmic management. In Recital 36, it labels employment a “data-intensive” field excluded from the simplified information regime it creates. In principle, this preserves full transparency guarantees under Article 13 GDPR and prevents employers from invoking those derogations. The Omnibus, however, adds no specific labour safeguards, and the cumulative effect of the changes still favours employers.

A new derogation to Article 9 GDPR permits residual special-category data in AI datasets, provided controllers avoid collecting such data, delete them where possible and otherwise prevent them from influencing outputs or being disclosed. Together with the new Article 4a AI Act, which exceptionally authorises processing of special-category data for bias detection and correction, this normalises the re-use of worker-related sensitive data for AI research, development, training and operation, within safeguards largely internal to controllers. At the same time, the Omnibus clarifies personal data for a given entity by stating that information is not personal data where that entity lacks means reasonably likely to identify the person concerned. Analytics providers handling pseudonymised worker datasets without a re-identification key may therefore consider their processing non-personal data and outside the GDPR, even though the same datasets remain personal data for employers.

The new Article 88c GDPR allows processing of personal data to develop and operate an AI system or model on the basis of legitimate interests under Article 6(1)(f), unless Union or national law requires consent, subject to safeguards such as data minimisation, enhanced transparency and an unconditional right to object. This consolidates employers’ reliance on legitimate interests for wide use of HR records, log files and communication data to build and run AI systems for scheduling, performance assessment and monitoring.

snip