Legislation in motion
Proposal: exception for incidental special category data in AI development (Article 9(2)(k) and 9(5) GDPR)
- Date
- Status
- proposal
- Body
- Europese Commissie
- Reference
- COM(2025) 837 final, artikel 3, punt 3 (wijziging artikel 9 AVG); 2025/0360(COD); ST 15698/25
What it is about
A new exception to the ban on processing special categories of personal data would cover the development and operation of an AI system or model, provided appropriate technical and organisational measures are taken to avoid collecting or otherwise processing such data. Where such data are nevertheless identified in training, testing or validation datasets or in the AI system or model, the controller must remove them; if removal requires disproportionate effort, the controller must in any event effectively protect them without undue delay from being used to produce outputs and from disclosure to third parties. Recital 33 states the derogation does not apply where special category data are necessary for the processing; Article 9(2)(a) to (j) then applies. The EDPB and EDPS recommend adding the words incidental and residual to the enacting terms (Joint Opinion 2/2026, para 48).
What this means in practice
If adopted, you would no longer need to fit incidental special category data in AI training into one of the existing Article 9 exceptions. You would need demonstrable filtering measures, a removal process, and documentation of when removal is disproportionate and what protection you apply instead. As of 27 October 2026 this is still a proposal: the Council has had a negotiating mandate since 21 October 2026 and Parliament has no position yet, so do not rely on it yet.
The GDPR articles concerned
Source: Raad van de EU, register (COM(2025) 837 final als ST 15698/25); EDPB-EDPS Joint Opinion 2/2026checked on 27 October 2026
Summary and practical reading by Praxikon. Not legal advice; the source prevails.
Connections
What connects to this development
Part of the file
Themes where this returns
The counterpart in the other law
- Article 2 AI Act: Scope
via Using special categories of personal data to detect bias
- Article 3 AI Act: Definitions
- Article 5 AI Act: Prohibited AI practices
- Article 6 AI Act: Classification rules for high-risk AI systems
- Article 10 AI Act: Data and data governance
- Article 50 AI Act: Transparency obligations for providers and deployers of certain AI systems
Case law
- Schrems v Meta: no unlimited retention and aggregation of data for targeted advertising
2024-10-04 · final, Hof van Justitie van de EU (Vierde kamer), Maximilian Schrems tegen Meta Platforms Ireland Limited
- Lindenapotheke: competitors may sue over GDPR breaches and pharmacy order data are health data
2024-10-04 · final, Hof van Justitie van de EU (Grote kamer), ND tegen DR (twee Duitse apothekers)
- Meta v Bundeskartellamt: competition authority may find a GDPR breach, strict conditions for legal bases behind personalised advertising
2023-07-04 · final, Hof van Justitie van de EU (Grote kamer), Meta Platforms Inc., Meta Platforms Ireland Ltd en Facebook Deutschland GmbH tegen Bundeskartellamt
- Russmedia: an online marketplace operator is controller for personal data in adverts and must check before publication
2025-12-02 · final, Hof van Justitie van de EU (Grote kamer), X tegen Russmedia Digital SRL en Inform Media Press SRL
Guidelines
- Guidelines 03/2026 on web scraping in the context of generative AI
2026-07-07 · under consultation, European Data Protection Board (EDPB)
- Guidelines 05/2020 on consent under Regulation 2016/679
2020-05-04 · final, European Data Protection Board (EDPB)
- Guidelines 1/2026 on processing of personal data for scientific research purposes
2026-04-15 · under consultation, European Data Protection Board (EDPB)
- EDPB and EDPS adopt Joint Opinion 2/2026 on the Digital Omnibus
2026-02-10 · final, European Data Protection Board en European Data Protection Supervisor
- European Economic and Social Committee adopts opinion on the Digital Omnibus
2026-03-18 · final, Europees Economisch en Sociaal Comité
- European Central Bank issues opinion on the Digital Omnibus
2026-03-10 · final, Europese Centrale Bank
- Dutch DPA (AP) publishes position paper on the Digital Omnibus and the AI Omnibus
2026-01-13 · final, Autoriteit Persoonsgegevens
Enforcement and fines
- Ten municipalities fined a total of 250,000 euros for unlawful files on Muslim residents
2026-02-03 · final, Autoriteit Persoonsgegevens
- Formal warning to the Dutch Minister of Education, Culture and Science not to put the CABR war archive online and searchable
2024-11-26 · final, Autoriteit Persoonsgegevens
- Clearview AI: 30.5 million euro fine and penalty orders for illegal facial database
2024-05-16 · final, Autoriteit Persoonsgegevens
Legislation in motion6 of 17
- Proposal: exception for biometric verification under the data subject's sole control (Article 9(2)(l) GDPR)
2025-11-19 · proposal, Europese Commissie
- Council: Irish Presidency continues with a revised compromise, Antici Group 11 September 2026
2026-09-11 · under negotiation, Raad van de Europese Unie, Iers voorzitterschap
- Council: Cyprus Presidency tables negotiating mandate, Coreper vote of 26 June 2026 cancelled
2026-06-22 · under negotiation, Raad van de Europese Unie, Antici-groep (vereenvoudiging) en Coreper
- Commission publishes Digital Omnibus proposal COM(2025) 837
2025-11-19 · proposal, Europese Commissie
- European Parliament: joint ITRE-LIBE draft report, amendments tabled, no committee vote yet
2026-06-22 · under negotiation, Europees Parlement, commissies ITRE en LIBE (gezamenlijke commissie)
- Committee of the Regions adopts opinion on the Digital Omnibus
2026-05-07 · final, Europees Comité van de Regio's