In the draft presented by the Commission, the objective of simplification does not appear neutral. The Digital Omnibus does not merely eliminate redundancies, correct inconsistencies, or standardize terminology. Instead, it shifts the perspective from which data protection is conceived—from the user to the infrastructure that processes and manages those same data.

To fully appreciate this change in perspective, one must start from the central role that the GDPR assigns to the individual and the protection of the data relating to them. Under the current regulatory framework, data are considered “personal” if they objectively identify the user (such as IP addresses or technical identifiers like cookies), or if they are capable of identifying them when combined with other information. By virtue of their “personhood,” the user thus has the right to have such data protected. This right is exercised concretely through explicit consent to data processing or, more often, by accepting a temporary reduction of that right (how many times are we asked to accept cookies for commercial purposes simply to access a website?).

The Digital Omnibus draft does not explicitly abolish these principles but reframes them by prioritizing the perspective of the entity managing the infrastructure rather than that of the user.

Put simply, what matters is not only whether a piece of information “is” objectively personal under the current definition, but also what the organization handling the data claims to be able to do with it.

An immediate example is the “like” on a social media post.

A “like” is, in the abstract, an anonymous data point—a simple digital signal that reveals nothing about the user who generated it.

But if the platform declares that it uses that data to associate preferences with a user and personalize content and advertisements, the same data point becomes personal.

Conversely, where no such declaration exists, the data processed by the organization would be considered nonpersonal and therefore not fully protectable.

Within the Digital Omnibus framework, then, data would become “personal” only if the organization declares that it uses them to directly or indirectly identify the user and their individual preferences—potentially diminishing the protections currently afforded to digital users.

A similar mechanism applies to sensitive data. The GDPR situates sensitive data within the sphere of human dignity and personal integrity, imposing enhanced protections on that basis.

The Digital Omnibus draft, however, would instead make such protections depend on the infrastructure’s ability to manage those data properly. The sensitivity no longer lies intrinsically in the data, but becomes proportional to the quality of the process governing them.

Under this new conception of digital rights, the protection of personal and sensitive data shifts from a foundational principle to a variable linked to the functioning of the digital infrastructure. It is not denied, but it is conditioned—first, on what the organization declares about the data; second, on the ability of platforms, administrations, and providers to demonstrate that they have ensured such protection.

For these reasons, rather than a simplification, the Digital Omnibus draft appears to move toward a deregulation of digital rights, whose identification would be “delegated” to the very companies that process them—above all, the big tech firms.