digital economy regulation

In its negotiating mandate, the Council broadly supports the Commission's proposal to consolidate EU data legislation into the Data Act but introduces several changes. These include greater flexibility for member states in designating competent authorities, further safeguards for trade secrets in mandatory data sharing, changes to business-to-government data sharing in case of public emergencies and extending the possibility to impose early termination penalties to all types of cloud services. Contrary to the Commission, the Council would not repeal the Platform-to-business Regulation, which it considers to still be necessary to protect business users of online platforms.

This edition features, among others, the moratorium on draft national laws that may overlap with the proposed Kids Act; the Commission's acceptance of an action plan presented by Temu to address its infringements of the Digital Services Act (DSA); a Commission's consultation on a voluntary code of conduct on online fraud and scams under the DSA; and a Cullen International analysis of the main amendments proposed by the Council to the data protection provisions of the Digital Omnibus proposal. It also lists events taking place this week.

In its negotiating mandate, the Council introduces significant changes to the Commission’s proposal, notably rejecting the revised definition of personal data in favour of more targeted rules on pseudonymisation. Regarding the use of personal data in AI development and operation, it maintains the possibility of relying on legitimate interests while tightening the conditions for processing special category data (e.g. health data). It preserves rules governing cookies under the e-Privacy Directive, expanding consent exemptions and reducing the period before consent can be requested again if it was refused. Regarding the EU single-entry point for reporting security incidents, the Council favours national entry points over the Commission’s proposed solution.

This edition features the Council’s position on the Digital Omnibus proposal; the European Parliament’s indicative timetable for the Cloud and AI Development Act; a stakeholder discussion on the proposed Kids Act and its interplay with the forthcoming Digital Fairness Act proposal; the Commission’s launch of formal proceedings against Booking.com under the Digital Services Act (DSA); a dialogue between very large online platforms and digital services coordinators on out-of-court dispute settlement under the DSA; and a new Commission’s support study on financial scams on digital platforms. No relevant events were identified this week.

At an event organised by Cullen International, the European Parliament's co-rapporteur for the proposed Cloud and AI Development Act (CADA), Diego Solier (ECR, Spain), outlined an ambitious legislative timetable, with a draft report expected by 10 November 2026. He identified cloud sovereignty requirements as a key issue in the legislative negotiations and expressed openness to simplifying the four-level framework. The European Commission clarified how the framework would work in practice, including safeguards against third-country interference and implications for public procurement.

Speakers discussed proposed rules to protect minors online and how far the forthcoming Digital Fairness Act should extend beyond the scope of the EU Kids Act.