Brussels considers reforms that ease GDPR obligations for mid-sized companies, simplify rules on cookie banners and streamline overlapping digital legislation. The Commission rules out a pause of the EU’s flagship Artificial Intelligence Act but signals scope for targeted adjustments. The plans were presented in the European Parliament’s LIBE Committee this week as part of a debate on the Digital Simplification Package.
One concrete proposal for the simplification package would be to extend GDPR exemptions for record-keeping. Currently, only SMEs (small and medium-sized enterprises), firms with fewer than 250 employees, can benefit from an exemption. The Commission now wants to extend that relief to “small mid-caps” with up to 750 employees.
Conditions for record-keeping to ease
“It extends the scope of the current derogation, so that, in addition to SMEs and organisations with less than 250 employees, it also covers small and mid-caps, organisations with less than 750 employees”, said Julien Mousnier, Director for Rule of Law, Fundamental Rights and Democracy at DG JUST.
It extends the scope of the current derogation, so that, in addition to SMEs and organisations with less than 250 employees, it also covers small and mid-caps, organisations with less than 750 employees – Julien Mousnier, DG JUST
The change would trim the conditions for when companies must keep records. At present, three separate criteria can trigger record-keeping obligations. However, under the new plan, there would be just one. The only point considered is whether the processing activity is considered “high risk”, such as in cases involving sensitive categories of personal data or large-scale monitoring.
Some MEPs voiced concerns that simplification risks going too far. MEP Birgit Sippel (S&D, DEU) warned that the concept of what determines an SME needs clarification. “Depending on the definition, it seems that simplification is made for 90% of all companies”, Ms Sippel added, “this doesn’t make sense”.
Reduce the ’cookie fatigue’
The Commission is also revisiting the rules on cookies. Endless banners have led to what Brussels officials now call ’cookies fatigue’, where the constant need to click through warnings risks undermining trust in the system.
“Another pressing point raised by stakeholders is the very old story of cookie banners and consent fatigue”, said Yvo Volman, Director for Data at DG CONNECT. He told MEPs that companies and consumer groups alike are calling for “pragmatic adjustments” to reduce the burden.
One option raised in Parliament by MEP Markéta Gregorová (Greens, CZE) is a default opt-in system, where cookies would be blocked unless the user explicitly agrees. Mr Volman pushed back against that interpretation. Asked directly if this was under consideration, he replied that it was “not the first option”.
You might be interested
Partially stop the clock?
The Artificial Intelligence Act (AI Act) is one of the main points under scrutiny as part of the simplification agenda. Several voices, including Mario Draghi, have called for a pause in the implementation of future provisions. The Commission, however, insists that the law will not pause, but does not discard the need for adjustments.
There’s not going to be an overall moratorium on the AI Act. That’s not on the table. – Yvo Volman, DG CONNECT
“There’s not going to be an overall moratorium on the AI Act. That’s not on the table”, Mr Volman told MEPs. “The idea is not at all to have an overhaul of the AI Act at this moment in time. We see there are a number of practical issues, and there can be adjustments to handle these challenges. What we want to do is to make sure that it works in practice.” He explained that rather than re-opening the law, the Commission intends to ease compliance by offering guidance, model contracts, and an AI helpdesk to be launched in October.
For some lawmakers, those assurances weren’t enough. MEP Michael McNamara (Renew, IRL) argued that it risked looking like regulatory capture. “I just can’t think of too many more examples of a law which is made in 2024 which is the subject of such extensive lobbying and is now proposed to be amended so quickly before parts of it have even come into effect”, he said, questioning: “Is there a danger that that’s purely in response to the extensive lobbying that has happened?”
MEP Sippel pressed further, pointing out that the Commission’s rejection of a full pause still left questions unanswered. “Saying that on AI, there will be no overall stop the clock. Of course, that opens the question: will there be a partial stop the clock?”, she asked.
Cut overlaps and red tape
Another strand of the simplification will focus on reducing redundancies across the EU’s digital rulebook. Commission officials have identified overlaps between the Free Flow of Non-Personal Data Regulation, the Data Governance Act, the Open Data Directive and the Data Act. Besides, found duplicative reporting in the Cybersecurity Act.
“We are in particular looking at the Free Flow of Non-Personal Data Regulation, but also at the coherence between the Data Governance Act and different parts of the Open Data Directive and the Data Act”, said Mr Volman. “And we also have some overlaps in the cybersecurity area where we can simplify reporting obligations. The idea is not to lower standards”.
In the same spirit of administrative simplification, Brussels is preparing to launch a Digital EU Business Wallet, designed to streamline how companies interact with public authorities across the single market. Marie-Hélène Pradines of DG GROW said the initiative would “allow this new category of small mid-caps to grow in their competitiveness”.
Omnibus coming soon
The consultation on digital simplification runs until mid-October, after which the Commission will finalise the omnibus proposal. The timing of this discussion is also shaped by the one-year review of Mario Draghi’s report. Draghi called for a simplification of digital regulation. He argued that GDPR implementation had increased data costs and suggested that the AI Act’s next stage should be “paused until we better understand the drawbacks”.
On top of that, last week the commission launched a consultation on digital simplification. Executive Vice-President Henna Virkkunen describes the initiative as looking for “an innovation-friendly rulebook”.
