高木浩光＠自宅の日記

In a previous post on the leaked “Digital Omnibus” draft, I played with the idea hidden in noyb’s name: None of Your Business – in other words, irrelevant. My point was that the GDPR already contains, in plain sight, a principle that should be at the core of the debate but is almost never mentioned: Article 5(1)(c)’s demand that data be adequate, relevant and limited to what is necessary in relation to a purpose. The real question is not how much “personal data” the law can cover in the abstract, but which data are any controller entitled to take into account for a given decision.

Since then, the Digital Omnibus proposal has been published, and noyb has issued a long report criticising it. The public debate has largely been framed as a familiar clash: on one side, a Commission accused of “watering down” the GDPR by narrowing the definition of personal data and creating new exceptions for AI and research; on the other, civil-society actors defending a maximal scope for “personal data” and a strong version of data minimisation.

In this post I want to argue that this is the wrong axis of conflict. Both sides are fighting over how broad the law’s coverage should be, while largely ignoring what the law was actually designed to control. The Omnibus debate is being treated as a war over definitions, when it should be treated as an opportunity to recover the original focus of data protection: the fairness of decisions about individuals, and the prevention of their being made on the basis of irrelevant data.

To make that case, I will first say something about the “maximal scope” paradigm that dominates current criticism of the Omnibus. I will then turn to the research and AI provisions, explain why both the Commission and noyb mis-locate the risks, and finally suggest a different way of looking at scope – one that re-reads “processing of personal data” in line with its directive-era function.

1. The “Maximal Scope” Paradigm and Its Limits

1.1 How the Omnibus Debate Frames Article 4(1)

A central target of current criticism of the Digital Omnibus proposal is the suggested rewording of Article 4(1) GDPR, the definition of “personal data”. In noyb’s reading, the new text would introduce a strongly controller-relative element into identifiability: whether information is “personal data” would depend on the specific controller’s perspective, resources or reasonable efforts. Pseudonymised data held by actors who lack re-identification keys might therefore fall outside the definition for them, even if another actor could identify the same records.

For noyb, this is not just an unfortunate drafting choice but a constitutional problem. The reasoning, roughly, is as follows:

• the Charter of Fundamental Rights protects the “protection of personal data”;
• the Court of Justice has repeatedly read “personal data” and “processing” very broadly;
• therefore, any legislative move that appears to reduce that scope is a direct threat to fundamental rights.

On this view, the definition of “personal data” in Directive 95/46/E.C., as interpreted in landmark CJEU judgments, has been effectively “constitutionalised” by Article 8 of the Charter. And what is “constitutionalised” is understood as the breadth of the definition: the more generously we interpret “any information relating to an identified or identifiable natural person”, the more robust the protection of Article 8 must be.

From this vantage point, the only safe strategy is to insist that almost any information that can, in some chain of events, be linked to an individual must be treated as “personal data”, and that almost any operation involving that information must be treated as “processing”. The Omnibus proposal is thereby cast as an attempt to introduce controller-relative “subjectivity” into what ought to remain an objective, all-encompassing definition – a move that would undermine legal certainty, fragment enforcement and invite a race to the bottom.

I will call this way of thinking the maximal scope paradigm: the belief that the primary way to protect fundamental rights is to push the conceptual reach of “personal data” and “processing” as far as possible and then defend that maximal line against any retreat. Different actors occupy this paradigm in different ways – NGOs like noyb, some authorities and parts of the academic debate – but what they share is the assumption that “more situations legally qualifying as processing of personal data” almost automatically means “more effective protection.”

1.2 The Original Target of Data Protection: Decisions, Not “Data as Such”

Historically, however, the normative focus of European data protection instruments has never been “data as such”. It has been the use of data in systems of decision-making: credit scoring, employment screening, social security adjudication, policing, risk assessment, and so on. The early data protection laws, as well as their international precursors, were motivated by concerns that automated or computer-supported decisions about individuals could be made in opaque ways, based on incomplete, irrelevant or biased information, compiled in powerful, centralised files.

This orientation is visible in two features that are often overlooked in current debates.

First, the concept of processing was originally tied to what one might call an informational pipeline: a systematic sequence of operations through which data are collected, stored, combined, analysed and used to support decisions or actions. It was this pipeline – and the risks it created for individuals subjected to it – that justified a set of procedural and substantive constraints. The inclusion of “collection”, “use”, “disclosure” and “erasure” in the definition was meant to capture the different stages of that pipeline, not to transform any isolated mention of a person’s name into “processing” in the full legal sense.

Secondly, the much-cited triad of “adequate, relevant and not excessive” was framed as a data quality principle for decision-making. Its function was to ensure that decisions affecting individuals are based on information that has a rational link to the purpose of the decision, that is sufficiently complete and accurate for that purpose, and that does not include extraneous or prejudicial details. The idea was not to minimise data in the abstract, but to constrain the informational basis of decisions so that they are fair, non-arbitrary and non-discriminatory.

If one keeps this decision-oriented perspective in view, the relation between scope and protection looks different. What matters is not primarily how many pieces of information fall under the label “personal data”, but which informational pipelines and which decision contexts are brought within the reach of data protection law. A conception of “processing” that indiscriminately covers everything from one-off journalistic mentions to complex, automated profiling systems may be rhetorically expansive, but it risks obscuring precisely those structural features – centralisation, automation, iterative use – that generated the need for a specific legal regime in the first place.

1.3 A Preview: Two Layers of Protection

From this angle, the maximal scope paradigm is problematic in two ways.

It is over-broad, in that it extends the full conceptual and doctrinal apparatus of “processing of personal data” to contexts where the characteristic risks of data protection law are only marginally present. Treating every isolated reference to an individual, every casual photograph, or every transient log entry as “processing” subject to the GDPR may be logically possible under a literal reading of “any information relating to…”, but it stretches the concept far beyond the original risk profile it was designed to address. In doing so, it invites either pervasive non-compliance in everyday life or the proliferation of exceptions and derogations, which in turn make the law more complex and less intelligible.

At the same time, it is under-protective where protection is most urgently needed. By focusing energy on defending the outer conceptual perimeter of “personal data”, it diverts attention from the internal structure of those processing operations that truly matter: large-scale profiling, scoring and decision-support systems. Here, the crucial questions are not whether some fragment of information can be said to “relate” to an individual in the abstract, but whether the overall pipeline of processing is structured in such a way that decisions about individuals are based on adequate and relevant data, subject to meaningful contestation, and constrained by clear prohibitions on certain kinds of inferences.

Put differently, insistence on an ever-expanding notion of “personal data” risks functioning as a substitute for the harder work of identifying, and regulating, those decision contexts that require heightened protection. It can make it politically easier to denounce any perceived narrowing of scope – such as controller-relative identifiability in Article 4(1) – without having to say very much about which kinds of processing the fundamental right to data protection actually targets, and why.

To get out of this dead end, we need to recall that data protection law has always worked on two layers at once:

• a decision layer, which governs how data are used in concrete decisions about individuals, and where “adequate, relevant and limited to what is necessary” should be understood as a genuine relevance requirement; and
• a flow layer, which governs how data can move between contexts – purpose limitation, restrictions on re-use and onward disclosure – in order to prevent future decisions from being made on data that have no rational link to their purpose.

The rest of this post will unpack this two-layer structure and show how it helps to reframe the Omnibus debates about scientific research, AI and personal data definitions.

2. Scientific Research and AI: Data Minimisation without Decision Context

2.1 How the Omnibus and noyb Frame Scientific Research

A second focal point of the Omnibus debate is the proposed new definition of “scientific research” in Article 4(38) and the accompanying changes to purpose limitation and information duties, notably Article 13(5). The Commission’s draft defines scientific research, in essence, as “any research” that “can also support innovation”, supplemented by a long list of criteria referring to growth of society’s “knowledge and wellbeing”, adherence to “ethical standards in the relevant research area”, and similar elements.

noyb’s report offers a sharp and, in many respects, justified critique of this approach. It points out that:

• the core term “research” is left so broad that it could cover almost anything, from “sifting through a library” or “using Google Search” to watching rats in a laboratory;
• the phrase “any research which can also support innovation” extends the scope to mere possibilities (“can”) and by-products (“also”), so that virtually any data-driven activity in the name of innovation could qualify;
• the requirement that research must be able to “support innovation” risks excluding areas of academic work not aimed at innovation in the economic or technological sense; and
• references to “growth of society’s general knowledge and wellbeing” and to compliance with “ethical standards” are so indeterminate that they effectively outsource the definition of a Charter-limiting concept to private or sectoral ethics codes.

On this basis, noyb argues that the proposed definition, combined with an expanded framework for research exemptions, amounts to a “blanket allowance of further processing for a broadly and ill-defined ‘research purpose’”, which would likely fail the Charter’s requirements of necessity and proportionality. The Commission appears, in this reading, to be sacrificing the Article 7 and 8 rights on the altar of an amorphous “innovation” agenda.

At first glance, this critique appears squarely aligned with a rights-protective stance. Yet its internal logic again rests on two familiar premises: first, that the core of data protection is data minimisation as a direct emanation of Articles 7 and 8 and Article 52(1), and second, that the main threat posed by an overbroad research definition is the erosion of this minimisation and of purpose limitation as such. The questions of which types of research, and which decision contexts, ought to fall under stricter scrutiny remain largely implicit.

2.2 Research without Decisions vs Research Feeding Decisions

A decision-oriented perspective – one that takes seriously the role of adequacy and relevance in decision-making – suggests a different way to cut the problem.

On the one hand, there are forms of research that do not themselves feed into concrete decisions about identifiable individuals. Classic statistical and scientific uses of data, where the outputs are aggregate patterns, coefficients or models describing populations, may raise important issues of ethics, distributive justice and epistemic bias. But in terms of data protection, their risk profile is largely mediated by what happens after research: whether and how the resulting insights are embedded into operational decision systems.

On the other hand, there are forms of research that are structurally wired into treatment decisions: credit risk models developed on customer databases, hiring algorithms trained on past applicants, insurance pricing models, fraud detection tools. Here, the line between “research” and “operation” is thin. The same structured datasets used to develop the models are used, or readily usable, to support consequential decisions about individuals.

In this second family, what matters for data protection is not that “research” in the abstract uses more data than strictly necessary, but that the resulting decision systems may operate on data that are not relevant to the decision purpose. The core risk is arbitrary or discriminatory treatment: music taste influencing credit limits, social media activity affecting hiring, neighbourhood proxies standing in for ethnicity in insurance pricing. These are precisely the kinds of problems the adequacy and relevance requirement was originally meant to prevent.

From this angle, the Omnibus proposal’s changes to Article 4(38) and 13(5) are problematic, but not primarily because they offend an abstract ideal of data minimisation. They are problematic because they:

• blur the distinction between research that merely generates statistical insight and research that is structurally embedded in decision pipelines; and
• loosen purpose limitation and transparency duties in a way that weakens what I will later call the flow layer: the set of rules that restrict how data can move between contexts in order to prevent their use in irrelevant or discriminatory decisions.

noyb’s critique rightly attacks the vagueness of the definition and the risk of “innovation” being used as a carte blanche for further processing. But by casting the issue mainly in terms of Charter-compliant data minimisation, it misses the opportunity to ask the decisive question: which research-generated datasets are likely to flow into decision contexts, and how should their re-use be constrained to prevent irrelevant or discriminatory decision-making? This is the perspective I developed in my earlier post on the Omnibus debate, where I argued that both the Commission and noyb tend to overlook the GDPR’s explicit relevance requirement in Article 5(1)(c).

2.3 AI and Special Categories: Two Activities Confused under Article 9(2)(k) and (5)

The same pattern recurs, in sharper form, in the Omnibus proposal for Article 9(2)(k) and (5), dealing with AI and special categories of data. The draft introduces a new derogation for “processing in the context of the development and operation of an AI system … or an AI model”, accompanied by a paragraph 5 that requires controllers to implement “appropriate organisational and technical measures” to avoid the processing of special categories in training, testing and validation, and to remove such data where identified, or at least to prevent them from influencing outputs or being disclosed if removal would require disproportionate effort. The proposed recital 33 expressly frames this as a derogation from the Article 9(1) prohibition “in order not to disproportionately hinder the development and operation of AI”.

noyb criticises this structure on familiar grounds. It argues that AI is precisely the kind of opaque, large-scale processing that the data protection principles were originally designed to constrain; carving out a new derogation for AI development and operation is therefore backward-looking and threatens to hollow out the very safeguards that were written with such systems in mind. It also points out the loose drafting (“in the context of”, “appropriate measures”, “disproportionate effort”) and the risk that the derogation becomes a general permission for AI developers to retain special categories so long as they can claim to have implemented some minimisation efforts.

Again, this line of attack is understandable, but it presupposes that “AI development” is a unitary activity and that the relevant Charter risk can be captured by the volume and sensitivity of data processed. The actual situation is more complex.

As I argued in that earlier blog post, the label “AI development” currently covers two fundamentally different activities:

• Treatment AI, such as credit scoring, hiring and insurance models, trains on genuine systematic datasets: customer or candidate databases that are prototypical “personal data” in the sense of data protection law. Here, database-oriented requirements make structural sense: minimise unnecessary special categories in training sets, remove them where inappropriately included, protect the sensitive training data against disclosure or misuse.

• Generative AI training on public web text, by contrast, operates on scattered fragments of already public information to extract statistical patterns. It does not create systematic individual records; the resulting models do not, in normal operation, contain addressable records of specific persons’ sensitive characteristics. The main risks lie not in disclosure of special categories about identified individuals, but in the amplification of biases and stereotypes in generated content.

For the second family, Article 9(5)’s requirements are simply mis-specified. Instructing controllers to “remove” special categories from a corpus of heterogeneous web pages assumes a database-like structure that does not exist: what exactly is to be removed – sentences, paragraphs, entire documents? The “where possible” qualifier acknowledges the impracticality without providing a coherent standard. The language about preventing “disclosure” of special categories presupposes a context in which disclosure means revealing specific individuals’ sensitive data from a controlled database, not producing new text in which health or religion are mentioned in the abstract.

By lumping these structurally different activities together under a single derogation, the Omnibus proposal repeats the conceptual conflation already visible in the personal data definition. At the same time, and more importantly from a decision-oriented viewpoint, it misplaces regulatory attention:

• Generative AI training on scattered public text, which normatively should not be treated as personal data processing at all because it never constructs systematic datasets suitable for decisions about individuals, becomes the direct target of impractical, database-oriented requirements.

• Treatment AI operation, where structured datasets are used to make consequential decisions about individuals, receives relatively little targeted attention. Article 88c recognises AI operation as a legitimate interest, but provides no mechanism to enforce the relevance requirement of Article 5(1)(c) in this context. Irrelevant characteristics such as music preferences, social media activity or religious affiliation may thus be factored into decisions under the banner of “legitimate interest”, subject only to an individual right to object.

In short, both the Omnibus proposal and much of its criticism, including noyb’s, focus on how much and what kind of data AI systems may process, while leaving largely untouched the question whether the data used in AI-supported decisions are relevant to the decision purpose and how to prevent cross-context re-use of data in ways that generate arbitrary or discriminatory outcomes. That is precisely the gap that a relevance-based reading of Article 5(1)(c) is meant to fill.

2.4 So What Should Happen to the Research and AI Exceptions?

At this point the obvious question is: if both the Commission and noyb are framing the problem in the wrong way, what would a better treatment of research and AI actually look like? It seems clear that one political driver of both the new research definition and the AI derogation in Article 9(2)(k) – and of the attempt to redefine personal data – is the fear that, under the current reading of “processing of personal data”, even web-scale AI training and other large-scale analytics are automatically sucked into the full GDPR regime.

My answer is essentially the same as in my earlier post on the leaked Omnibus draft, but extended to the new definition and AI proposals.

1. Keep the existing statistical/research framework for the learning phase.
   Europe already has a coherent way to deal with large-scale analysis that does not itself feed into decisions about individuals: the combination of

2. the “compatibility” rule for statistical and scientific purposes in Article 5(1)(b) GDPR; and

3. the older Council of Europe framework on statistical processing, which allows restrictions of individual rights as long as no decisions or measures concerning individuals are taken on the basis of the statistical results.

AI training belongs here. Training a model on large datasets is, in substance, statistical processing. In this phase there is, by definition, no concrete decision purpose yet, so it makes little sense to apply a relevance test at the level of the model or its inputs. The adequacy and relevance requirement is a constraint on the informational basis of decisions, not on the structure of models in the abstract. The core protected interest is not offended simply because a learning algorithm has “seen” certain variables; it is offended when those variables are actually used as part of a decision pipeline about individuals.

1. Draw a hard line at the operational, decision-making phase.
   Once a trained model is used to support credit decisions, hiring decisions, insurance pricing, fraud detection and so on, we are no longer in the realm of “mere statistics”. We are in the realm of treatment AI, where the adequacy and relevance requirement must bite: every category of data that actually feeds into the decision pipeline must have a rational link to the decision purpose.

This distinction is crucial. A model may internally contain parameters influenced by many features, including features that would be irrelevant if used explicitly at decision time. What matters for data protection is which data are in fact taken into account when deciding about a person – which variables are read, combined and acted upon in the operational system. The legal architecture should therefore be very simple:

• learning / training = statistical or research processing, covered by existing rules for such purposes, on the strict condition that the outputs are not used directly to decide about individuals;

• operation = decision-making, subject to full data-quality scrutiny, including a serious enforcement of “adequate, relevant and not excessive” under Article 5(1)(c) with respect to the inputs actually used in the decision.

• No special AI derogation is needed – and a broad one would be harmful.
  If we treat AI training as statistical processing and AI operation as ordinary (but highly consequential) decision-making, there is no need for a new, AI-specific derogation in Article 9(2)(k) or elsewhere. On the contrary, a blanket derogation “for AI development and operation” risks doing exactly what I criticised in my previous post: it invites controllers to invoke “AI” as a magic keyword to justify both phases at once, while never asking the simple question at the operational phase: are the data we actually use in these AI-supported decisions relevant to the decision purpose?

• Special categories do not need an AI-only regime either.
  For the learning phase, the right question is not “how can we purge every trace of special categories from web-scale training corpora?”, but “how do we make sure that training corpora used for statistical purposes are not casually re-purposed into decision systems where special categories – direct or inferred – would be irrelevant to the decision purpose?”.

For the operation phase, if relevance is properly enforced, the distinction between directly revealed and inferred sensitive data becomes less important: both are ruled out wherever they are “none of your business” in light of the decision purpose. The problem, as I argued in the earlier post, is that we are currently trying to slim down Article 9 without first building the enforcement muscle around relevance at the decision layer.

In other words, instead of inventing AI-specific exceptions and research-specific shortcuts, we should put AI training back where it belongs – under the existing statistical/research framework – and concentrate regulatory energy on AI operation, where the relevance requirement finally has to be taken seriously at the point where decisions are made.

3. Decision Governance and Flow Governance: Re-reading “Processing of Personal Data”

The discussion so far already suggests that data protection operates on two interlocking layers:

• decision governance, where the law constrains how data are used to make or support decisions about individuals; and
• flow governance, where the law constrains how data can move between contexts, in order to prevent future misuse in irrelevant or discriminatory decisions.

We can now make this structure more explicit and ask how the Omnibus proposals affect each layer.

3.1 Two Complementary Layers of Protection

From a functional perspective, EU data protection law operates on two distinct but interdependent layers.

First, there is direct governance of decisions. Whenever personal data are actually used to make or support decisions about individuals, data protection law requires that the informational basis of those decisions meets the traditional data-quality standard: the data must be adequate and relevant to the purpose of the decision and not excessive. In modern language, there must be a rational link between the data items used and the legitimate decision purpose. This is where the classic “adequate, relevant and not excessive” formula belongs: it is a constraint on how decisions are made, not an abstract call to minimise data.

Second, there is preventive governance of data flows. Purpose limitation, restrictions on further use and onward disclosure, and the construction of “data silos” are not mysterious relics of a bygone era of database regulation. They are ex ante tools designed to prevent future violations of adequacy and relevance. The empirical intuition is simple:

Once data start to flow into new contexts, the probability that they will be re-used in decisions for which they are not relevant rises sharply.

If a dataset collected for one clearly defined purpose can be repurposed, combined and traded without structural constraints, it is only a matter of time before some actor uses it as input for decisions to which the data have no rational connection – credit scoring based on music taste, insurance pricing based on social media activity, hiring decisions based on political affiliation, and so on.

Seen in this light, purpose limitation is not a decorative recital about fairness. It is the central legal mechanism through which the law tries to shape the future graph of data flows: to determine which data can realistically end up feeding which decision systems. The decision layer governs the content of decisions (adequacy and relevance); the flow layer governs the routes through which data can travel into decision contexts in the first place.

Any attempt to redraw the boundary of “personal data” therefore has two effects:

1. It changes which operations count as “processing” for the purpose of direct decision governance; and
2. It determines where the preventive flow-governance layer applies at all. Data that fall outside “personal data” are not just exempt from information duties; they are exempt from purpose limitation and onward-transfer constraints, even if they later feed into decision systems.

The risk of the Omnibus proposal on personal data definitions is best understood at this second level.

3.2 How a Relative Personal Data Definition Undermines Flow Governance

The Omnibus proposal does not invent the idea that personal-data status may depend on the means of a particular controller; it codifies the Court’s relative approach, especially as expressed in more recent case law. The core idea is that information counts as personal data for a controller only if that controller has means that are “reasonably likely to be used” to identify the individuals concerned. Pseudonymised datasets held by actors who lack re-identification keys might therefore fall outside the definition for them, even if another actor could identify the same records.

On its face, this move is presented as a technical solution to a real problem: without some relativisation of identifiability, any data that someone could link to a person risks being treated as personal data for everyone. But once we look at the two-layer structure, a different picture emerges.

Consider a stylised scenario. A company collects information on music preferences – whether customers prefer jazz, rock or classical – linked to stable internal identifiers. At the time of collection, it pseudonymises the data and declares that they are used purely for market research. Under a relative definition, the company might argue:

• it does not hold the mapping from identifiers to real-world identities;
• it has no present means reasonably likely to be used to identify individuals;
• therefore, the dataset is not “personal data” for it.

If accepted, this position has a crucial consequence: purpose limitation never attaches to the dataset. The data have been collected and processed in structured form, but as long as they are treated as “non-personal” for that controller, the entire flow-governance layer of data protection simply does not apply.

Fast-forward several years. The company changes strategy and enters the credit-scoring market. It discovers that music preference correlates, in its dataset, with repayment history. It now has strong incentives to:

• re-establish or acquire a linkage between identifiers and individuals; and
• re-use the existing music-preference dataset as an input for credit decisions.

At that moment, the company will insist that it now has identification means and that the data now constitute personal data. But purpose limitation will be invoked too late. Because the data were originally classified as “non-personal”, there was no legal obligation to tie their collection and retention to a specific, limited set of purposes, or to treat later re-use for credit scoring as a purpose change requiring a fresh legal basis and renewed guarantees for the individuals concerned.

This is not an exotic edge case. It describes a systematic pattern of “purpose drift through claimed non-identification”:

1. At collection: claim non-personal status (no identification means), thereby avoiding purpose limitation and related constraints;
2. In the interim: enjoy maximal freedom to replicate, analyse and trade the dataset as “non-personal”;
3. At some later point, when a lucrative decision-application emerges: reclassify the data as personal and use them for consequential decisions, by which time the preventive layer has already failed.

The same logic applies not only to isolated companies, but to entire chains of actors. If upstream entities can treat rich, individual-level structured datasets as “non-personal” on the basis that they lack re-identification keys, those datasets can circulate freely until they reach actors who do have the means and incentives to link them to identified persons and embed them in decision systems. Purpose limitation was meant to constrain exactly such cross-context flows; a relative definition makes it easy to step outside its reach during the most critical stages of dissemination.

The Omnibus proposal’s empowerment of the Commission to designate certain categories of pseudonymised datasets as “non-personal” through implementing acts would exacerbate this risk. Once such a designation is made, entire classes of structured data can travel as if they were mere technical exhaust, while remaining perfectly suited for later reintegration into decision pipelines. What disappears is not only some marginal transparency duty; it is the ex ante requirement to ask, at each step of the flow, “what purposes justify moving these data into this next context?”

From a decision-and-flow-oriented perspective, then, the danger of the Omnibus redefinition is not primarily that it makes the GDPR less “broad” in an abstract sense. It is that it removes structured, decision-capable datasets from the preventive flow-governance layer at precisely the stages where that layer does its most important work.

At the same time, it is worth recalling that the GDPR already contains a gate in the form of its material scope clause. Article 2 confines the Regulation to the “processing of personal data”. The popular complaint that “the GDPR applies to everything” does not stem from the absence of such a gate, but from the way in which “processing” has gradually been flattened into “any handling of any information about a person” – including, in the political imagination, web crawling for AI training or other large-scale analytics. The Omnibus proposals take this perception of overbreadth at face value and try to cure it at the level of the definition of personal data itself. The maximal scope paradigm reacts from the opposite direction and defends the broadest possible reading of “personal data” and “processing”. What both moves have in common is that they leave the structural notion of processing untouched – and with it, the original idea that the material scope of the GDPR was meant to capture systematic, file-like processing pipelines, not every scattered mention of an individual.

3.3 A Decision-and-Flow-Oriented Scope Test

Against that background, if we take seriously both layers of protection, an alternative way of framing the scope question suggests itself. Rather than asking how far we can conceptually stretch the notions of “personal data” and “processing”, we should ask in which situations EU data protection law must, at a minimum, apply with full force across both layers.

A decision-and-flow-oriented test could be formulated, in preview, along these lines:

1. Systematic pipeline
   There must be a systematic informational pipeline in the original sense of “processing”: a structured sequence of operations on data organised according to stable categories or formats, not merely isolated mentions or ad hoc exchanges. This is the threshold that distinguishes “data” from scattered “information” and captures what early data protection instruments were designed to regulate.

2. Decision context
   The outputs of this pipeline are, or are reasonably likely to be, used in decision contexts that affect individuals’ legal or social position: credit, employment, insurance, social benefits, access to services, law enforcement, and comparable domains. Here the decision layer kicks in: Article 5(1)(c) must be interpreted and enforced as a genuine relevance requirement, demanding a rational link between each category of processed data and the stated decision purpose.

3. Cross-context flow risk
   The data in the pipeline can realistically flow into other decision contexts in which they would not be relevant, unless purpose limitation and onward-transfer rules apply. Where such cross-context drift is structurally plausible – as in large-scale analytics, AI development and platform ecosystems – the flow layer should apply from the moment the data are collected in structured form, regardless of whether the controller currently claims to have identification means.

On this view, the problem with the Omnibus redefinition of personal data is not that it abandons an abstract ideal of maximal scope. The problem is that it allows controllers to step outside this three-part test at will by declaring, at collection time, that they lack identification means – even when they are building exactly the kind of structured datasets that can later be fed into consequential decision systems. Once those datasets are born outside the legal category of “personal data”, the law’s ex ante capacity to shape their future flows is crippled.

The same test also helps to separate, conceptually, different families of AI-related processing. Generative-AI training on scattered public text corpora may fail the first and third prongs: it does not create systematic, individual-addressable datasets, and its outputs are not naturally wired into decision contexts. By contrast, treatment AI – credit scoring, hiring algorithms, insurance pricing models – falls squarely within all three: it operates on structured records, directly supports decisions about individuals, and its datasets have obvious cross-context re-use potential.

3.4 Re-reading “Processing of Personal Data” in Light of the Directive’s History

This interpretive proposal is not a call to rewrite the text of Article 4(1) GDPR. It is a call to re-read the existing concepts of “processing of personal data” and “personal data” in light of their directive-era function.

Historically, the structural understanding of “processing” was not an accidental by-product of outdated “file” concepts. The Commission’s 1990 proposal still spoke the language of files, but when the Parliament insisted on replacing “file” by “processing of personal data”, this was not meant to abandon the structural requirement altogether. It was meant to capture file-like processing pipelines, including on-the-fly decision systems that reproduce the same risks without a literal, centralised file. The shift from “file” to “processing of personal data” thus extended the concept along a functional line, rather than dissolving it into “any handling of any information”.

Some judgments – particularly in borderline cases – can be read as stretching the concept for specific factual constellations without turning “processing” into “any handling of any information” as a general rule. Where genuine tensions remain, they suggest that the Omnibus is premature in constitutionalising a maximalist scope at precisely the moment when the underlying concept still requires careful doctrinal clarification.

4. Conclusion: Not a War over Scope, but a Chance to Recover What Data Protection Was For

If you only read the open letters and press releases around the Digital Omnibus, it looks like a familiar drama. On one side, the Commission, accused of “watering down the GDPR” by narrowing the definition of personal data and creating new derogations for AI and research. On the other side, noyb and others, defending a maximal scope for personal data and a strong version of data minimisation.

My argument in this post, building on my earlier analysis, is that this is the wrong axis of conflict. Both sides are fighting over how broad the law’s coverage should be, while largely ignoring what the law was actually designed to control. From the 1970s onward, European data protection law was not about “data” in the abstract. It was about systems of decision-making: the pipelines through which structured data are collected, organised and used to allocate jobs, credit, insurance, social benefits and other advantages and burdens.

Seen from that angle, the core of the GDPR is not an abstract horror of “too much data”, but a pair of linked questions: which data may legitimately be taken into account in decisions about individuals, and how should we prevent data from flowing into decision contexts where they have no rational link to the purpose? That is what the data-quality principle and purpose limitation were originally built to address.

At this point, two natural questions may arise.

The first is that this may still sound like data minimisation by another name. After all, Article 5(1)(c) GDPR now literally speaks of data being “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”, and Directive 95/46/EC already spoke of “adequate, relevant and not excessive”. Hasn’t the law always been about minimising data?

My answer is that, historically, this triad was framed as a data-quality principle for decisions, not as a free-floating command to collect “as little data as possible”. “Not excessive” – and its later rephrasing as “limited to what is necessary” – was embedded in a standard that also demanded adequacy and relevance for a given decision purpose. Supervisory guidance often glosses “adequate” as “sufficient to properly fulfil your stated purpose”. But “sufficient” sometimes means more data, not less: more complete income information to avoid arbitrary denials of credit, more context to avoid misinterpreting a single data point, more nuance to prevent crude profiling. A pure minimisation reading, which treats “less data” as always better from a fundamental-rights perspective, erases this ambivalence and collapses adequacy and relevance into a one-dimensional “volume” metric. In that light, rebadging Article 5(1)(c) as the data minimisation principle is itself part of the problem: it obscures the original focus on relevance and sufficiency for decisions, and makes it easier to overlook situations where better protection in fact requires better – not thinner – data.

A second, closely related question is whether all this ultimately collapses into a call to strengthen Article 22 GDPR on automated decision-making. The recent battles around Article 22 are, in a way, a symptom of the same misframing. Because we forget that the data-quality principle already governs the informational basis of all decisions that take personal data into account, there is a tendency to load every concern about profiling and AI onto the narrow category of “solely automated” decisions in Article 22. One camp therefore demands an ever broader Article 22, hoping it will cure problems that actually belong in the general regime of Article 5(1)(c). Another camp concludes that Article 22 is an overreach that stigmatises even proper profiling that respects adequacy and relevance, and pushes to hollow it out or abolish it – a mood that is not entirely absent from the Omnibus debates.

What both sides risk forgetting is that Article 22 is a lex specialis for a very small subset of cases. The basic standard I have tried to reconstruct here is more general and more basic: it applies whenever personal data are used in decision-making at all, regardless of the mix of automation and human involvement. That standard lives primarily in Article 5(1)(c) and the surrounding data-quality and purpose-limitation provisions, not in Article 22. Strengthening Article 22 cannot substitute for taking the relevance requirement seriously across the board. Weakening Article 22 does not make decision systems benign if we continue to ignore adequacy and relevance at the decision layer and to relax flow governance so that irrelevant data can silently seep into consequential decisions.

Against that background, the real promise and danger of the Digital Omnibus become clearer. The promise is that the current controversy could have forced us to reopen the basic questions: what counts as “processing of personal data” in the structural sense? where do the characteristic risks of data protection actually arise? how should we distinguish statistical or learning phases from operational decision-making? The danger is that we instead constitutionalise a maximalist reading of scope at the very moment when the underlying concept of processing still needs careful doctrinal work – and, at the same time, quietly open back doors for exactly those structured datasets that most urgently require tight flow governance.

The alternative sketched in this post is modest in textual ambition but radical in effect. It does not call for rewriting Article 4(1); it calls for re-reading “processing of personal data” and Article 5(1)(c) in line with their directive-era function. It suggests that AI training should be treated as statistical processing under existing rules, and that the real regulatory energy should be directed at AI operation and other decision systems, where the adequacy and relevance requirement finally has to bite. And it suggests that both the Commission and its critics would do better to shift their attention from how far the legal concept of personal data can be stretched, to how the law governs the pipelines by which data flow into decisions. That, after all, was what data protection was for.