Bridging the legal-technical gap: practical insights on the Digital Omnibus
As part of the broader European Data Union Strategy, the Digital Omnibus proposes ways to simplify and consolidate EU data laws (GDPR, AI Act, DGA, DA, etc.). Through this simplification, the EU aims to increase the availability of data for AI development and to strengthen its global position in international data flows. As the Digital Omnibus remains at proposal stage, stakeholder feedback combining legal, technical and business perspectives is crucial. Discussions within the ACHILLES, DATAPACT, ART-AI, CERTAIN, ASCII Lab projects have highlighted the importance of having our finger on the pulse and enabling a cross-disciplinary dialogue. Therefore this workshop tackles concrete, hands-on topics concerning the practical impact of the Digital Omnibus drawing on examples from these projects in developing trustworthy, secure, and efficient data ecosystems. Particular attention will be given to the interaction between legal requirements and technical design. On the one hand, non-legal stakeholders should be aware of the Digital Omnibus proposal in order to integrate these evolving legal requirements in the technical solutions from the beginning. On the other hand, and from a legal perspective, there are uncertainties as to how certain technical safeguards can be operationalised technically in practice. This creates strong potential for cross-disciplinary dialogue, which this workshop aims to bring together through discussion and examples.
For example, the GDPR Digital Omnibus proposal specifies that residual processing of sensitive data in the context of AI development would not be illegal to the extent that certain privacy-by-design measures are implemented. Similarly, biometric verification may be allowed when data are stored under the sole control of the data subject. For the processing of data in the context of the development and operation of AI which may be based on legitimate interest, some specific safeguards are included (e.g. enhanced transparency, data minimization).
Across both the Digital Omnibus and the Digital Omnibus on AI, the concept of necessity and its thresholds are undergoing an evolution with respect to e.g. the processing of sensitive categories of personal data for bias mitigation or the implementation of automated decision making based on personal data. Such alterations to previously familiar necessity thresholds require regulated entities to reassess their operations, while new and, at this point, still subjective requirements for “appropriate safeguards” are introduced that warrant further guidance by the regulator. What would this mean in practice and how can this be achieved from a technical perspective requires careful consideration.
Moreover, in its integration of the DGA into the DA, the Digital Omnibus revises the regime for “data intermediation service” by rendering it voluntary instead of compulsory. Providers of such services would then have the choice of whether to seek registration as “data intermediation services provider recognized in the Union”. Conditions to receive this label are also modified and lightened to incentivize data intermediation service providers. Recalling the criticisms that have been expressed regarding the initial version of the DGA will contextualize these proposed changes and lay the groundwork for a discussion about the benefits and flaws of these proposed changes and on how to implement them in practice.
Drawing on ongoing work across automated contracting in data spaces, digital product passports, and cybersecurity compliance, this talk examines what it takes for compliance with legal obligations to be identified, verified and documented in practice. The Digital Omnibus pursues burden reduction through legislative simplification, but operationalising legal requirements in compliance lifecycles raises a prior question: what is the technical toolbox that needs to be in place for this, and how is this supported in the Digital Omnibus? This talk reflects on what we are learning from building this toolbox for compliance and contracting automation across multiple domains, how that interacts with the Digital Omnibus, and what questions remain open for the legal and technical communities to work through together.
