The Council of the EU adopted its negotiating position on the Digital Omnibus package. Austria, Estonia and Germany resisted the agreement. The position keeps the GDPR definition of personal data and adds a provision on pseudonymization. It simplifies data subject access request rules to reduce unfounded requests. It adds safeguards for processing special categories of personal data in AI development. The Council proposes stronger protection of trade secrets and tiered data reuse charges. Cookie rules remain under the ePrivacy Directive with new exemptions. Cybersecurity incident reporting would shift to member-state level with an EU-level information point. Trilogues on the final law are expected to start early next year. The European Commission released draft templates for secondary use of health data. A public consultation on these templates is open until mid-November. The Commission is investigating Booking.com’s compliance with the Digital Services Act. Temu’s action plan to remedy its DSA breach was accepted by the Commission.

• mid-November feedback deadline
• early next year trilogues start