The Council of the European Union adopted its negotiating position on Wednesday, 21st October, clearing the way for negotiations with the European Parliament once MEPs establish their position.
The measures form part of the European Commission’s Digital Omnibus package, introduced in November 2025, and represent one of Brussels’ most substantial attempts to simplify the regulatory obligations imposed on businesses operating across the single market.
The proposed reforms would modify several provisions of the GDPR, which has governed the processing of personal data across the EU since May 2018.
Rather than replacing the legislation, the Council wants to clarify existing obligations, particularly those concerning pseudonymised information, requests for access to personal data and the use of information in scientific research.
The agreed position retains the existing definition of personal data while introducing provisions intended to clarify when pseudonymised information can be linked to an identifiable individual.
Companies would also benefit from simplified procedures for handling manifestly unfounded or excessive data requests and from reduced information requirements in certain low-risk circumstances.
Another proposed change would extend the deadline for notifying authorities of personal data breaches, while establishing more consistent reporting templates across the EU.
For multinational companies, which currently navigate different interpretations of data protection obligations by national authorities, these provisions could reduce compliance costs and administrative duplication.
However, the changes have raised concerns among European privacy regulators.
In a joint opinion published in February, the European Data Protection Board and European Data Protection Supervisor warned that parts of the Commission’s original proposal could create legal uncertainty and undermine existing protections.
They were particularly concerned about proposals affecting the definition of personal data and the Commission’s potential role in determining when pseudonymised information falls outside GDPR requirements.
The Council’s decision to retain the existing definition addresses part of that debate, although the final legislative text remains subject to negotiations.
One of the most visible changes would affect the consent notices encountered by Europeans when visiting websites.
Under the Council’s proposal, additional categories of cookies and similar tracking technologies could be used without obtaining explicit consent, provided the relevant legal conditions are satisfied.
The proposed exemptions include technologies necessary to deliver a service, maintain device security or conduct audience measurement.
For website operators, publishers and online businesses, the changes could reduce the number of consent requests displayed to visitors and simplify technical compliance.
The current system has generated extensive legal disputes over whether consent is genuinely voluntary and whether tracking technologies collect information beyond what users have authorised.
EU Today has previously examined the enforcement of these obligations, including a Belgian court ruling concerning the legality of the advertising industry’s consent framework.
The latest proposal would not abolish consent requirements for commercial tracking or behavioural advertising. Technologies falling outside the permitted exemptions would remain subject to the applicable privacy rules.
The package also addresses the growing number of reporting obligations imposed on European businesses under overlapping cybersecurity legislation.
The Commission originally proposed a single European reporting mechanism for certain data and cybersecurity incidents.
Member states have instead agreed to establish national entry points, supported by an EU-level information system and provisions for coordinating cross-border notifications.
The Council’s position would also clarify the legal grounds for certain uses of personal data in artificial intelligence systems and introduce safeguards for processing sensitive information in specified circumstances.
These provisions follow increasingly complicated disputes over the application of European privacy legislation to AI development and automated decision-making.
As EU Today reported in its coverage of a major GDPR enforcement case involving Uber, automated processing already presents substantial compliance risks for companies operating within the bloc.
The Commission estimates that its wider digital simplification initiative could save European businesses up to €5 billion in administrative costs by 2029.
The initiative reflects pressure from European governments and business organisations to reduce the regulatory fragmentation that makes operating across multiple EU jurisdictions more expensive.
The Digital Omnibus is part of a broader legislative programme influenced by the competitiveness reports produced by former Italian prime ministers Enrico Letta and Mario Draghi.
Under the Council’s negotiating mandate, several existing data-related rules would also be consolidated, while provisions governing the protection of trade secrets would be strengthened.
The European Parliament must now determine its negotiating position before formal discussions between the institutions can begin. Until the legislation is agreed and adopted, existing GDPR, cookie consent and cybersecurity requirements remain in force.
The Council adopted its position on 21st October, proposing an exemption from the obligation to appoint an authorised representative in another EU country when the amount of packaging placed on that country’s market remains below one tonne per calendar year.
The measure addresses complaints from small and medium-sized enterprises that the Packaging and Packaging Waste Regulation, which became applicable on 12th August 2026, creates unnecessary expenses for companies engaged in relatively modest volumes of cross-border commerce.
The proposal forms part of the EU’s eighth legislative simplification package and will now be negotiated with the European Parliament.
Under the Packaging and Packaging Waste Regulation, businesses placing packaging or packaged products on the European market are subject to obligations concerning waste management and extended producer responsibility.
The extended producer responsibility system requires producers to contribute to the management of waste generated by products and packaging placed on the market.
For businesses operating across borders, the framework also includes requirements concerning authorised representatives in member states where producers are not established.
These representatives perform specified compliance functions and provide a point of contact for national authorities.
The system can create substantial administrative obligations for businesses trading in several countries, particularly when the quantity of packaging supplied to individual markets is limited.
A small Belgian retailer, for example, may sell products to customers in Germany, France and the Netherlands without maintaining physical operations in those countries.
The requirement to arrange representation separately across different markets can add compliance costs regardless of whether the volume of trade justifies them.
Under the Council’s proposal, eligible EU-based producers placing less than one tonne of packaging annually on another member state’s market could be exempted from appointing a representative there.
The threshold would be assessed by reference to the quantity placed on the market of the member state concerned.
However, the proposed exemption would not abolish the wider principle of extended producer responsibility or automatically release businesses from their other environmental obligations.
The regulatory changes come only two months after the EU’s revised packaging framework began applying across the single market.
The legislation, Regulation (EU) 2025/40, is intended to reduce packaging waste, improve recyclability and establish more consistent requirements for products and packaging materials.
It covers an extensive range of commercial activities, including manufacturing, retail, food distribution, transport packaging and online sales.
As EU Today reported when the regulation began applying in August, the legislation introduces new requirements affecting packaging design, materials and waste prevention.
However, the practical implications for smaller firms have generated pressure for modifications.
In September, EU Today examined the emerging campaign for simplification, as business organisations questioned whether the compliance system adequately reflected the circumstances of smaller producers.
The Council’s latest agreement represents a further legislative step, replacing general calls for administrative relief with a specific negotiating position.
The Commission also issued detailed implementation guidance in June 2026 after receiving numerous questions from member states and businesses about how the regulation should be interpreted.
The proposed exemption would not apply without conditions.
The Council’s negotiating mandate includes a safeguard allowing the relevant authorities to respond when a producer fails to comply with extended producer responsibility obligations.
It also provides for the European Commission to review the duration of the temporary suspension by 31st December 2030, ahead of its scheduled expiry in 2032.
The timetable reflects the possibility that broader reform of producer responsibility arrangements could replace the temporary measure.
The Commission is preparing a Circular Economy Act intended to address additional problems affecting Europe’s recycling and secondary raw materials markets.
That initiative could provide a more comprehensive framework for the administration of producer responsibility systems across member states.
For now, the Council has opted for a narrower intervention designed to reduce the immediate burden on smaller companies without reopening the entire packaging regulation.
The proposal also reflects a broader problem with European regulatory integration.
Although companies can sell goods throughout the single market, compliance requirements often remain administered through national systems, requiring businesses to deal with separate authorities and procedures.
For multinational corporations, such costs can be distributed across substantial commercial operations. For smaller exporters and online retailers, similar administrative requirements can consume a much greater proportion of turnover.
The Council argues that removing unnecessary representation requirements would support cross-border trade while preserving the objectives of European environmental legislation.
The Irish presidency will now seek agreement with the European Parliament on the proposed amendment.
Until that legislation is adopted and becomes applicable, businesses must continue to comply with the existing rules, including relevant national producer responsibility requirements.
The agreement, announced on Wednesday, 21st October, follows negotiations between the Council and European Parliament over changes to prudential requirements and the regulation governing securitised financial products.
The reform package agreed by EU negotiators would reduce capital requirements for lower-risk transactions, introduce a new category of resilient securitisations and simplify administrative procedures for financial institutions and investors.
It forms part of the EU’s Savings and Investments Union initiative, which aims to channel more private capital into the European economy.
Securitisation allows banks and other lenders to combine financial assets, including mortgages, consumer credit and corporate loans, into securities that can be purchased by investors.
By transferring some of the financial risks associated with these assets, banks can reduce the amount of regulatory capital they are required to maintain against particular exposures.
This can increase their capacity to extend new loans, although it does not guarantee that additional lending will follow.
The provisional agreement would recalibrate capital requirements according to the risk of individual transactions.
Lower-risk securitisations would receive more favourable treatment, while higher capital requirements would continue to apply to riskier structures.
A new category of resilient securitisations would be introduced alongside the existing framework for simple, transparent and standardised transactions, commonly known as STS securitisations.
The agreement would also strengthen supervision of independent organisations responsible for verifying compliance with the STS criteria.
The Council said that third-party verifiers would become subject to EU-level supervision, with the aim of improving consistency across national markets.
The reforms address a long-standing concern that European banks face higher administrative and capital costs for securitisation than competitors operating under other regulatory systems.
Following the financial crisis of 2008, European authorities introduced tighter rules governing structured financial products, including restrictions intended to improve transparency and ensure that lenders retained appropriate exposure to credit risks.
The resulting framework, which began applying in 2019, strengthened investor protection but also increased compliance costs.
The European Commission proposed the latest review in June 2025, arguing that the existing arrangements had constrained the development of securitisation as a financing tool.
According to the Association for Financial Markets in Europe, approximately €252.3 billion in securitised products was issued across Europe in 2025, with €156.3 billion placed with investors.
Those figures cover the wider European market, including activity outside the EU.
Brussels regards the development of deeper financial markets as necessary to finance infrastructure, technological investment and industrial development.
As EU Today previously reported, the EU’s largest economies have also been examining proposals to strengthen supervision and reduce fragmentation across European capital markets.
The potential benefits of securitisation are not automatic.
Research published by economists on the European Central Bank’s website in September 2026 found that banks using synthetic securitisation increased corporate lending only modestly, while also distributing more capital to shareholders.
Synthetic securitisation allows banks to transfer credit risk to investors without necessarily removing the underlying loans from their balance sheets.
The researchers found that a one per cent increase in synthetic securitisation issuance was associated with an increase of approximately 0.02 per cent in corporate loan growth.
Their findings also indicated that banks participating in the synthetic securitisation market made greater use of capital released through these transactions to increase dividend payments.
The study suggests that easing capital requirements alone may not generate the substantial expansion in business lending envisaged by European policymakers.
Credit demand, economic conditions and banks’ commercial decisions will also influence whether the reforms produce measurable increases in investment financing.
The provisional agreement includes additional measures intended to encourage participation by institutional investors.
Investment limits for certain regulated funds, known as UCITS, would be increased, while targeted changes would allow insurers and reinsurers greater participation in specified synthetic securitisation transactions.
The package also seeks to facilitate securitisation arrangements used to finance infrastructure projects before they become operational.
Together, these provisions could widen the investor base and make financing structures available to a broader range of businesses and projects.
However, transferring credit exposure between banks and investors does not eliminate the underlying risk.
If borrowers default or the financial institutions providing protection encounter difficulties, losses may still emerge within the wider financial system.
European regulators will therefore have to assess whether the new classification and supervisory arrangements adequately reflect the risks of different securitisation products.
The political agreement now requires legal finalisation and formal approval by the Council and European Parliament.
The new arrangements would then form part of the EU’s wider programme to strengthen financial markets and reduce barriers to investment across the single market.
Login