The EU's 'Simplified' Legislative Package: When Deregulation Rhetoric Meets the Enforcement Capacity Gap
At the fifth AI Week hosted by the Baden-Württemberg Data Protection Authority, European Parliament Greens/EFA Group advisor Ralf Bendrath and University of the Arts Berlin professor Max von Grafenstein argued separately that the European Commission's legislative discourse has evolved from 'competitiveness' to 'simplification' and now openly discusses 'deregulation,' while corporate surveys show a need for more enforcement guidance rather than less regulation; meanwhile, the state plans to cut 40% of positions at its data protection authority by 2029. Von Grafenstein proposed a mechanism using 'proof of effectiveness' to let the market replace some human oversight.
At the fifth AI Week hosted by the Baden-Württemberg State Data Protection Authority (LfDI Baden-Württemberg), Ralf Bendrath, advisor to the Greens/European Free Alliance group in the European Parliament, described the evolution of the European Commission's legislative discourse over recent years: from 'competitiveness' to 'simplification,' and now to open talk of 'deregulation.' He pointed out that this legal modification tool, known as 'Omnibus laws,' changes multiple regulations at once. While ostensibly aimed at reducing administrative burdens, it actually touches upon the rule system the EU established over the past decade to protect fundamental rights and the environment.
Specifically regarding the 'Digital Omnibus Legislative Package' proposed in November 2025, Bendrath listed several modifications he believes attack the core of the General Data Protection Regulation (GDPR): redefining personal data, limiting the information rights of data subjects, and issuing passes for artificial intelligence training. Additionally, the Commission plans to decide via implementing acts when pseudonymized data should be considered anonymous, and to expand the definition of 'scientific research' to cover the application of existing knowledge in 'novel ways'—which Bendrath considers primarily a backdoor for AI training. A survey by noyb showed that only 7% of Meta users surveyed in Germany wanted their data used for AI training.
However, not all simplifications are opposed. Bendrath welcomed the one-click rejection function for cookie banners, binding machine-readable browser signals (similar to the previously failed 'Do Not Track' standard), and a unified list across Europe triggering privacy impact assessments. He cited former European Central Bank President Mario Draghi to acknowledge that the GDPR is indeed subject to serious inconsistencies in execution across member states.
Max von Grafenstein, Professor at the University of the Arts Berlin, approached the issue from a practical perspective. He participated in writing a review by innovation economist Nicholas Martin, which showed that venture capital received by European startups has decreased since 2018, but von Grafenstein argued that the root cause lies in legal uncertainty and complexity, rather than the level of protection itself. He drew a key distinction: lowering compliance costs does not have to come at the expense of protection levels.
Von Grafenstein places his greatest leverage on the concept of 'state of the art' in Article 25(1) of the GDPR. In environmental law, this term means 'the most effective available technology' and has operated for decades; in data protection, it has hardly been activated. He suggested that regulators require companies to submit proof of effectiveness, such as demonstrating that cookie banners effectively reject tracking rather than merely complying formally. This would allow the market to spontaneously generate better solutions, just as diesel particulate filters once spurred an effective market.
An instance derived from his research project YourPrivacyLawyer is Consenter, a consent agent: after users set preset preferences, the agent automatically executes choices. Research shows that users made more targeted decisions, and services with identifiable high protection levels actually received more consents—turning data protection into a competitive advantage.
However, a disturbing contradiction emerges. A Bitkom survey shows that 90% of enterprises believe targeted reform of the GDPR is necessary, but looking closely at their demands: 88% complain that specific provisions are unclear, 61% complain about a lack of guidance from regulators, and 76% hope for a centralized database of regulatory decisions. In other words, enterprises are asking for more regulatory guidance and more reliable precedents, not less regulation.
Ironically, Baden-Württemberg is doing the opposite. According to the budget draft of the Green-Black coalition government, Tobias Keber's data protection authority will gradually cut 40% of its positions by 2029, despite receiving additional tasks. A broad alliance comprising the Network for Data Protection Expertise, the Chaos Computer Club Stuttgart branch, Digitalcourage, the German Association for Data Protection, FIfF, and the Humanistic Union Baden-Württemberg has sent an open letter opposing these cuts, citing Article 8(3) of the Charter of Fundamental Rights of the European Union and Article 52(4) of the GDPR, demanding that regulators must be equipped with sufficient resources to 'effectively perform their duties.'
Von Grafenstein calls this the 'scaling problem' of data protection: regulators can no longer review all cases. He points out that legislators can 'lower' data protection costs simply by cutting regulatory resources—'this is location policy.' His proposed way out is to let the market work for regulators: requiring companies to submit proof of protection effectiveness, so that companies themselves have the incentive to develop better solutions. But he also admits that someone still needs to review these proofs.
The core tension of this argument lies in the fact that the political drive for deregulation comes from the digital industry's annual lobbying expenditure of 151 million euros (with Meta alone spending 10 million euros), while actual compliance needs point toward more, not less, regulatory interaction. When both happen simultaneously—rules are loosened and enforcement resources are cut—the actual efficacy of protection levels faces systemic risk beyond paper promises. Bendrath offers a pragmatic bottom-line judgment: unlike enacting new laws, there are already rules in effect here; if parties cannot agree, everything remains as it is.