On 28 September 2026 the Estonian Actors' Union spoke out against the European Commission's Digital Omnibus, arguing that its GDPR changes would let AI developers use actors' faces, voices, likenesses and movements without separate permission or pay. Union head Reimo Sagor told ERR News that the requirements "would be weakened" and that new ambiguities would open the door to such use. Culture Minister Heidy Purga said her ministry shares the concern. A Justice Ministry official, Kristi Värk, said Estonia's position in the Council is that a legal basis, including consent, and extra safeguards for AI development are needed (ERR News).
The objection is small in scale, but it puts a concrete face on an abstract drafting dispute.
The case for the Omnibus
The strongest argument for the reform deserves a fair statement. European AI developers face real legal uncertainty. The GDPR was drafted before large-scale model training, and companies cannot easily tell when a model or dataset counts as anonymous. Cookie banners have produced consent fatigue without improving privacy. The Commission tabled the Digital Omnibus on 19 November 2025 to cut that friction. Among other things, it would treat pseudonymised data as non-personal for entities that lack the means to re-identify people. It would also confirm that "legitimate interest" can be a legal basis for training AI (European Parliament Legislative Train). A pro-innovation publication should welcome the goal of legal clarity.
Where the design goes wrong
Clarity is not the same as loosening. The EDPB and the European Data Protection Supervisor issued a joint opinion on 11 February 2026. They did not oppose simplification. They supported higher breach-notification thresholds, common templates and action on cookie-banner fatigue. But they strongly opposed the redefinition of personal data. In their words, it goes "far beyond a targeted or technical amendment", does not accurately reflect Court of Justice case law, and would significantly narrow the concept of personal data. They also objected to giving the Commission implementing-act powers over how post-pseudonymisation data is classified (EDPB).
That matters for performers. A voice or a movement pattern can be personal data precisely because it identifies someone. If the definition depends on whether a particular recipient has the means to re-identify, a studio could argue that a motion-capture dataset it holds is not personal data. The actors' fear is that a narrower definition turns a legal right into an argument about technical capability.
The legitimate-interest provision is a different problem. The regulators did not support adding a specific AI provision at all. They pointed out that legitimate interest "may be used, in some cases" for model development under existing law, so new wording was unnecessary (EDPB). Their December 2024 Opinion 28/2024 already set out a three-step test for legitimate interest. It weighs necessity and the balance against individual rights, and it looks at whether people reasonably expected the use given how the data was collected (EDPB). So the framework the Omnibus wants to clarify is already workable. The new text adds a signal that could be read as a presumption in favour of training, and litigation over that signal would fall on the smallest rights-holders.
A proportionate alternative
The pro-innovation position is not to defend every line of the GDPR. It is to fix the specific bottlenecks and leave the foundations alone. Three changes would do that:
- Keep the personal-data definition as the Court of Justice has developed it. Address anonymisation uncertainty through EDPB guidance and codes of practice, not statutory redefinition.
- Anchor AI-training language to the existing balancing test. If the Omnibus mentions legitimate interest, it should restate the necessity and expectation steps from Opinion 28/2024. It should not imply a default.
- Treat likeness and performance as a distinct risk. Where a system is built to reproduce a specific person's face, voice or movements, consent or a licence should remain the expected route.
This last point is where Estonia's stated position is useful. Värk's emphasis on consent as a legal basis, with extra safeguards, matches what the union asks. Purga said she would raise copyright protections at a meeting of Nordic-Baltic culture ministers in Tallinn in early October. That is the right instinct, because much of the performer problem sits at the boundary between data protection and copyright, and the GDPR alone cannot settle it.
What comes next
The file is still open. In Parliament, the lead committees are ITRE and LIBE, and Estonian MEP Marina Kaljurand is rapporteur for LIBE. A draft report was published on 22 June 2026, and more than 1,750 amendments had been tabled by the July joint committee discussion. In the Council, a COREPER II vote planned for 26 June was cancelled amid unresolved disagreements, and work continues under the Irish Presidency (European Parliament Legislative Train). No Parliament vote has taken place.
That gives the co-legislators room to narrow the definition change. It is the provision most criticised by the EU's own data protection authorities, and the one with the weakest link to the stated goal of cutting compliance costs. Faster AI development in Europe depends on predictable rules that citizens and creators can trust. If performers conclude that Brussels traded away their control over their likeness for a modest reduction in legal uncertainty, the political backlash will make future simplification harder. The better outcome is targeted relief on breach reporting, cookies and anonymisation guidance, with the definition of personal data left as it is.