Monthly Archives: April 2026

The new information notice exemption: What businesses need to know

Legal news

The EU’s Digital Omnibus initiative aims to reshape GDPR, and one of its most practical changes for organizations is a new exemption from the obligation to provide information notices when collecting personal data. While this may sound technical, the effect is straightforward: reducing administrative burdens while maintaining strong data protection standards.

THE CURRENT LEGAL FRAMEWORK. According to Article 13 GDPR, controllers must provide data subjects with detailed information about how their personal data is processed, including:

  • Identity of the controller;
  • Purposes and legal basis of processing;
  • Retention periods;
  • Data subject rights.

Today, limited exemptions exist. Notably, Article 13, par. 4 GDPR states that controllers are not required to provide information if the data subject already has such information.

THE DIGITAL OMNIBUS REFORM: EXPANDING EXEMPTIONS. DigitalOmnibus seeks to expand this exemption by amending Article 13 GDPR. Under the proposed reform, controllers may be exempt from providing an information notice if:

  • The processing is unlikely to result in high risk (e.g., limited data and simple processing activities);
  • There are reasonable grounds to assume the data subject already possesses the relevant information.

Importantly, this exemption does not affect the data subject’s right to access their data under Article 15 GDPR.

The EDPB–EDPS JOINT OPINION. The European Data Protection Board (“EDPB”) and European Data Protection Supervisor(“EDPS”) have expressed support for the reform, noting that it could reduce unnecessary administrative burdens.

However, they also warn that the new wording of Article 13 GDPR may create legal uncertainty and divergent interpretations across Member States. To mitigate this, clear definitions outlining the scope of the exemption are essential.

Additionally, the EDPB and EDPS emphasize the need for controllers to provide full Article 13 information upon request of the data subject.

POTENTIAL BENEFITS FOR COMPANIES. If adopted, the reform may positively impact on companies. But how?

  • Reducing administrative burden: No need to draft or deliver notices where users already know the essential information;
  • Ensuring Cost-efficient compliance: Fewer internal approvals, less paperwork, and reduced content updates.

CONCLUSION. The Digital Omnibus regulation, if approved, could significantly reform GDPR transparency obligations. Businesses should continue monitoring developments to understand how and when these changes will take effect.

The future of GDPR? Focus on Automated Decisions

Legal news, , , , , , ,

The Digital Omnibus Proposal.  The so called “Digital Omnibus” regulation proposal promises to lighten the burden of compliance with data protection legislation. Its aim is “to ensure that the rules continue to be fit for supporting innovation and growth”. Europe is not giving up on privacy, but it is willing to simplify it.

EDPB and EDPS Chime In.  The proposal, published in November 2025, has recently been the subject matter of a joint opinion by the European Data Protection Board and the European Data Protection Supervisor. While these two bodies are apparently in favor of facilitating GDPR compliance and strengthening consistency in its application, they express significant concerns regarding the impact of the changes on the fundamental rights and freedoms of individuals. They also fear that the proposal will create additional legal uncertainties.

The GDPR of the Future.  Gitti and Partners is embarking in a series of blog posts to explain what the GDPR may look like if the Digital Omnibus proposal becomes law. Today we focus on changes to the provision on automated decisions.

Automated Decisions: from Right to Prohibition.  Article 22 of the current GDPR regulates automated individual decision-making. The current language of the provision frames the rule as a “right”: a data subject is entitled not to be subject to a decision based solely on automated processing, unless certain conditions apply. The new proposal, instead, shapes a similar rule as a prohibition.

Conditions for Automated Decisions.  The new proposal reads (new language highlighted in yellow): “1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means. […]”

While – as before – the automated decision is legitimate if necessary to enter into or perform a contract with the data subject, the novelty is that the necessity of the automated decision can be assessed “regardless of whether the decision could be taken otherwise than by solely automated means”. Therefore:

  • An automated decision that does not produce any legal effects is fine.
  • An automated decision producing legal effects may be based on automated processing only if the decision is necessary to enter into or perform a contract with the data subject.
  • No automated decision is allowed unless it is necessary to enter or perform a contract with the data subject.
  • In order to add certainty to the interpretation of the requirement of “necessity”, the proposal clarifies that the decision may be regarded as necessary also if the decision could be made by a human. In the words of the EDPB/EDPS opinion, “the requirement of necessity does not mean that the mere fact that a decision could theoretically also be taken by a human should prevent the controller from taking the decision by solely automated means”.
  • In short, “The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing” (recital (38) of the Digital Omnibus proposal).

Bottom line: the data controller may choose a human decision process or an automated decision process so long as they are necessary to enter into or perform a contract with the data subject.

In conclusion, as shown in the “AI First” policy, the EU is now worried that AI may not be fully exploited. The above changes are supposed to encourage automated decisions even if such decisions could be taken by a human being.

Stay tuned for more angles of the Digital Omnibus.