Legislation in motion
European Parliament: joint ITRE-LIBE draft report, amendments tabled, no committee vote yet
- Date
- Status
- under negotiation
- Body
- Europees Parlement, commissies ITRE en LIBE (gezamenlijke commissie)
- Reference
- Procedure 2025/0360(COD); COM(2025)0837; ontwerpverslag PE786.818; amendementen PE786.820, PE790.967, PE790.968, PE791.071, PE791.072, PE791.073, PE791.873, PE791.874, PE791.883
What it is about
The Commission proposal COM(2025)0837 (Digital Omnibus) was published on 19 November 2025; committee referral was announced in Parliament on 19 January 2026. ITRE and LIBE handle the file jointly, with rapporteurs Aura Salla (ITRE, EPP) and Marina Kaljurand (LIBE, S&D), both appointed 25 February 2026. IMCO (rapporteur Alex Agius Saliba) and JURI (rapporteur Brando Benifei) give opinions. The joint draft report PE786.818 is dated 22 June 2026; nine amendment documents were tabled on 27 July 2026. On 15 September 2026 OEIL lists the procedure as Awaiting committee decision: there is no committee vote, no plenary vote and no Parliament position yet.
What this means in practice
Parliament has no position yet and trilogues with the Council and Commission have not started. The proposed GDPR changes, such as those to the definition of personal data and Article 22, are therefore not law and may still change substantially. Keep working under the current GDPR for now. Because the committee vote, the plenary position and the trilogues are still to come, a final text is not to be expected in the short term.
The GDPR articles concerned
Source: Europees Parlement, Legislative Observatory (OEIL)checked on 15 September 2026
Summary and practical reading by Praxikon. Not legal advice; the source prevails.
Connections
What connects to this development
Part of the file
Themes where this returns
The counterpart in the other law
- Article 3 AI Act: Definitions
- Article 5 AI Act: Prohibited AI practices
- Article 6 AI Act: Classification rules for high-risk AI systems
- Article 14 AI Act: Human oversight
- Article 16 AI Act: Obligations of providers of high-risk AI systems
- Article 25 AI Act: Responsibilities along the AI value chain
- Article 26 AI Act: Obligations of deployers of high-risk AI systems
- Article 50 AI Act: Transparency obligations for providers and deployers of certain AI systems
- Article 86 AI Act: Right to explanation of individual decision-making
Case law8 of 11
- IAB Europe: the TC String is personal data and the industry body is a joint controller
2024-03-07 · final, Hof van Justitie van de EU (Vierde kamer), IAB Europe tegen Gegevensbeschermingsautoriteit (België)
- Council of State: 600,000 euro fine for wifi tracking in Enschede stays annulled
2026-07-29 · final, Raad van State, Afdeling bestuursrechtspraak
- EDPS v SRB: pseudonymised data are not always personal data for everyone, but the information duty applies from collection
2025-09-04 · final, Hof van Justitie van de EU (Eerste kamer), Europese Toezichthouder voor gegevensbescherming (EDPS) tegen Gemeenschappelijke Afwikkelingsraad (SRB)
- Gelderland District Court: bankruptcy trustee is controller, DPA fine for unsecured hard drive cut to 58,125 euros
2025-08-07 · status not established, Rechtbank Gelderland
- Dun & Bradstreet: right to an intelligible explanation of an automated decision, trade secrets are no absolute ground for refusal
2025-02-27 · final, Hof van Justitie van de EU (Eerste kamer), CK tegen Magistrat der Stadt Wien, met Dun & Bradstreet Austria GmbH als andere partij
- Overijssel District Court revokes DPA fine for wifi tracking in Enschede
2024-02-02 · final, Rechtbank Overijssel
- Deutsche Wohnen: a fine on a legal person needs no identified natural person, but does require fault
2023-12-05 · final, Hof van Justitie van de EU (Grote kamer), Deutsche Wohnen SE tegen Staatsanwaltschaft Berlin
- SCHUFA: a credit score on which third parties draw strongly is automated decision-making
2023-12-07 · final, Hof van Justitie van de EU (Eerste kamer), OQ tegen Land Hessen, met SCHUFA Holding AG als interveniënt
Guidelines8 of 10
- Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679
2018-05-25 · final, Article 29 Working Party, bekrachtigd door de European Data Protection Board (EDPB)
- Guidelines 02/2026 on Anonymisation
2026-07-07 · under consultation, European Data Protection Board (EDPB)
- Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models
2024-12-17 · final, European Data Protection Board (EDPB)
- Guidelines 07/2020 on the concepts of controller and processor in the GDPR
2021-07-07 · final, European Data Protection Board (EDPB)
- Dutch DPA (AP) publishes position paper on the Digital Omnibus and the AI Omnibus
2026-01-13 · final, Autoriteit Persoonsgegevens
- Guidelines 05/2020 on consent under Regulation 2016/679
2020-05-04 · final, European Data Protection Board (EDPB)
- Guidelines 01/2025 on Pseudonymisation
2025-01-16 · adopted, European Data Protection Board (EDPB)
- EDPB and EDPS adopt Joint Opinion 2/2026 on the Digital Omnibus
2026-02-10 · final, European Data Protection Board en European Data Protection Supervisor
Enforcement and fines
- Dutch DPA fines Uber 824.99 million euros for automated driver deactivation
2026-08-21 · under appeal, Autoriteit Persoonsgegevens
- Coolblue fined 40,000 euros on objection for cookies without consent
2024-12-23 · status not established, Autoriteit Persoonsgegevens
Legislation in motion6 of 17
- Proposal: reformulation of automated individual decision-making (Article 22 GDPR)
2025-11-19 · proposal, Europese Commissie
- Proposal: relative definition of personal data (Article 4(1) GDPR)
2025-11-19 · proposal, Europese Commissie
- Proposal: implementing acts on when pseudonymised data ceases to be personal data (new Article 41a GDPR)
2025-11-19 · proposal, Europese Commissie
- Council: Irish Presidency continues with a revised compromise, Antici Group 11 September 2026
2026-09-11 · under negotiation, Raad van de Europese Unie, Iers voorzitterschap
- Proposal: cookie rules move from ePrivacy to the GDPR, with new exceptions and a six-month rule (new Article 88a GDPR and Article 5(3) ePrivacy)
2025-11-19 · under negotiation, Europese Commissie
- Proposal: definition of scientific research, purpose limitation and information duty for research (Article 4(38), 5(1)(b) and 13(5) GDPR)
2025-11-19 · under negotiation, Europese Commissie
Analysis
- Agentic AI under the EU AI Act: how to govern autonomous agents
2026-07-07
- Agentic AI governance: obligations, controls and how to get started under the EU AI Act
2026-07-07
- Does an AI agent fall under the EU AI Act?
2026-07-07
- Who is responsible when an AI agent makes mistakes?
2026-07-07
- The draft high-risk classification guidelines: the two routes under Article 6 explained
2026-06-13
- Commission Guidelines on High-Risk AI: How the Article 6(3) Filter Works
2026-05-20