Europe Shouldn’t “Move Fast and Break Things” With Fundamental Rights

Key Takeaways

• EU Digital Omnibus could dilute GDPR data protections
• Redefining “personal data” may allow broader online tracking
• New rules could make high‑risk AI decisions default automated
• Self‑assessment shifts compliance burden onto companies, not regulators
• Sensitive data use may persist despite weaker safeguards

Pulse Analysis

Europe’s digital regulatory framework has long been a benchmark for privacy and algorithmic oversight. The GDPR set a global standard by requiring data‑by‑design safeguards, transparent processing, and strong enforcement. Now, the Digital Omnibus seeks to “simplify” that regime, but the simplification comes at the cost of narrowing the definition of personal data and allowing companies to rely on self‑assessment rather than independent audits. This shift mirrors the tech industry’s “move fast and break things” ethos, where rapid innovation is prized over pre‑emptive risk management.

The practical fallout could be significant. By treating anonymized identifiers as non‑personal, firms could resume pervasive cookie‑based tracking without the consent mechanisms that currently protect users. Simultaneously, the proposals would lower the bar for high‑risk AI systems, permitting automated credit, hiring, or benefits decisions to become the default, with only a formal human review. The “legitimate interest” carve‑out for AI training further normalises bulk data use without explicit consent, echoing recent Meta practices where users struggled to opt out. Delayed obligations for high‑risk AI mean that potentially discriminatory models could be deployed at scale before any accountability measures take effect.

For businesses, the regulatory drift creates both opportunity and risk. Companies with deep legal and technical resources will likely navigate the looser rules more easily, gaining a competitive advantage over smaller players and startups that lack such capacity. However, the erosion of clear safeguards may invite consumer backlash, litigation, and fragmented national responses as member states attempt to plug gaps. Stakeholders urging a balanced approach argue that simplification should not equate to deregulation; preserving robust privacy and AI safeguards remains essential to maintain trust, ensure fair competition, and protect fundamental rights in the digital economy.