Commission to offer mid-cap companies data protection relief

Euronews

20-05-2025

The European Commission will offer relief to small mid-cap companies burdened by the current scope of the General Data Protection Regulation (GDPR) in a rule simplification package known as an Omnibus to be published on Wednesday, according to a working document seen by Euronews.
Currently, companies with fewer than 250 employees are exempt from the data privacy rules to reduce their administrative costs, the Commission now proposes to extend this derogation to the so-called small mid-cap companies.
Small mid-cap companies can employ up to 500 employees and make higher turnovers. Under the plan - the Commission's fourth such Omnibus - such companies will only have to keep a record of the processing of the users' data when it's considered 'high risk', for example private medical information.
The change comes seven years after the GDPR took effect. Since then the rulebook has shielded consumer data from US tech giants but is also perceived as burdensome for smaller and mid-sized companies that often did not have the means to hire data protection lawyers.
The biggest fine issued under the rules so far is €1.2 billion on US tech giant Meta: the Irish data protection authority fined the company in 2023 for invalid data transfers.
Although fines are generally lower for smaller businesses, at up to €20 million or 4% of annual turnover they remain significant.
In the Netherlands for example, VoetbalTV, a video platform for amateur football games, was fined €575,000 by the Dutch privacy regulator in 2018. Although the company appealed and the court overturned the fine, it had to file for bankruptcy.
Both EU lawmaker Axel Voss (Germany/EPP), who was involved in steering the legislation through the European Parliament, and Austrian privacy activist Max Schrems, whose organisation NOYB filed numerous data protection complaints with regulators, called for different rules for smaller companies earlier this year.
Under the plan, 90% of the businesses – small retailers and manufacturers -- would just face minor compliance tasks and would not need an in-house data protection officer anymore, no excessive documentation and lower administrative fines, capped at €500,000.
Voss said his proposal would not weaken the EU's privacy standards, but make it 'more enforceable, and more proportionate'.
Similar calls are coming from the member states: the new German government stressed in its coalition plan that it will work on EU level to ensure that 'non-commercial activities (for example, associations), small and medium-sized enterprises, and low-risk data processing are exempt from the scope of the GDPR.'
By contrast, civil society and consumer groups have warned that the Commission's plan to ease GDPR rules could have unintended consequences.
On Tuesday, privacy advocacy group EDRi stated in an open letter that the change risks 'weakening key accountability safeguards' by making data protection obligations depend on company size rather than the actual risk to people's rights. It also fears this could lead to further pressure to roll back other parts of the GDPR.
Consumer advocates share similar concerns, in a letter from late April, pan-European consumer group BEUC warned that even small companies can cause serious harm through data breaches. It argued that using headcount or turnover as a basis for exemptions could create legal uncertainty and go against EU fundamental rights.
Both groups say the focus should instead be on better enforcement of existing rules and more practical support for small companies.
Meanwhile reforms of the data privacy law are under negotiation between the Council and the European Parliament. A new round of political discussions on the GDPR Procedural Regulation is expected to take place on Wednesday.
EU institutions are attempting to finalise a long-awaited deal to improve cooperation between national data protection authorities. The regulation is meant to address delays and inconsistencies in how cross-border cases are handled under the GDPR, by harmonising procedures and timelines.
According to experts familiar with the file, one of the main sticking points is whether to introduce binding deadlines for national authorities to act on complaints. While the Parliament has pushed for clearer timelines to speed up enforcement, some member states argue that fixed deadlines could overwhelm authorities and increase legal risks.
This change is however not expected to impact the Commission's 4th Omnibus package.
Chip giant Nvidia painted its roadmap for an artificial intelligence (AI), agentic AI, and humanoid future at the COMPUTEX technology conference in Taiwan on Monday, with CEO Jensen Huang highlighting the country as "the computer epicentre".
Taiwan-born Huang said he had been coming to the tech fair for the past 30 years and that his parents were in the audience.
Back in 2016, when he first started speaking about GTX graphic cards, he said no one understood what he was talking about and there were few clients. It was then that the company donated its technology to the then-non-profit OpenAI. The rest, as they say, is history.
Here are all the highlights from Huang's keynote speech, which Euronews Next attended.
Wearing his trademark black leather jacket in 30-degree Celsius heat and a humid climate, Huang announced that Nvidia would build an AI factory supercomputer, which he called the "first AI supercomputer for Taiwan's ecosystem".
He did not go into much detail, but he did say Nvidia would partner with Foxconn, the Taiwanese government, and chip maker TSMC.
The AI supercomputer will help fuel innovation and expand AI computing in Taiwan, which will help the country's scientists and start-ups, Jensen said.
"Our plan is to create an AI-focused industrial ecosystem in southern Taiwan," said Minister Wu Cheng-Wen of the National Science and Technology Council in a statement.
"We are focused on investing in innovative research, developing a strong AI industry, and encouraging the everyday use of AI tools. Our ultimate goal is to create a smart AI island filled with smart cities, and we look forward to collaborating with NVIDIA and Hon Hai to make this vision a reality".
"No company in history has ever revealed a roadmap for five years at a time, no one will tell you what's coming next," Huang said.
"But we realised Nvidia is not a tech company only anymore, it's an infrastructure company," he added.
As well as specifying that Nvidia is an AI infrastructure company, he added that the current infrastructure built on electricity and the Internet will be transformed into an 'intelligence infrastructure' where AI is integrated into everything.
Another thing we will be talking about in five years, says Huang, is tokens, which are any digitally transferable asset between two people, for example, but not limited to, cryptocurrency.
"Very soon, we will be talking about how many tokens we produce every hour," he said, adding that the AI infrastructure business will be measured in "trillions of dollars".
AI agents, described as digital assistants, will also continue to generate a buzz in the next five years, Huang said.
The future Huang predicts is that there will be many digital employees who will fill the labour shortage.
"The shortage of labour is limiting the world's ability to grow," he said, adding that AI agents can work with humans to plug this gap.
He said that Nvidia engineers have a "layer of AI agents" that help them with their tasks.
"We have to create the necessary tools for workers to manage and improve AI agents," he said, adding that AI agents could even speak to each other in the future.
But before the real development gets underway, Huang said that "we have to reinvent computing".
Lastly, Huang announced a new office for Nvidia's Taiwan operation, which will be called 'Nvidia Constellation'.
Engineers in Taiwan are growing beyond the limits of our current office, so we are building this brand new office".
Huang said that work on the building will start as soon as the company can, but did not set a firm date.