.svg)
On September 30th, 2026, our team hosted a conversation with privacy lawyer and chairperson of noyb, Max Schrems, European Commission officials Valda Beizitere (Legal and Policy Officer, DG JUSTICE & CONSUMERS) and Anne Schilmoller (Head of Sector for Data Flows and Judicial Cooperation, DG JUST, Unit 01 – International Affairs and Data Flows), and our CEO, Romain Gauthier.
During a passionate discussion attended by hundreds of privacy enthusiasts watching live, the group focused on the GDPR simplification proposal, the Digital Omnibus, and the fragile state of EU-US data transfers.
Scroll all the way down to the end of the article, or continue reading to discover the main talking points.
Where do EU-US data transfers stand in 2026?
Our speakers first tackled the state of the Data Privacy Framework (DPF), the legal framework governing data transfers between the European Union and the United States since 2023.
The history of cross-Atlantic data transfers is a long saga (see a recap here) and has seen new developments under the presidency of Donald Trump in the United States, first as a potential target as a Joe Biden executive order, and more recently following the Trump v. Slaughter case, where the U.S. Supreme Court struck down a statute under which Federal Trade Commission (FTC) commissioners could only be removed for cause, which means the President can dismiss commissioners at will.
This challenges the agency's structural independence, as it has been designated since 2000 as the privacy regulator responsible for enforcing EU-U.S. data transfer arrangements, leading organizations like Max Schrems’ noyb to challenge the DPF's validity.
Anne Schilmoller, Head of Sector for Data Flows and Judicial Cooperation at the European Commission, brought nuance to the question by reminding everyone in attendance that the decision for now is only about the FTC:
It’s important to keep in mind that the FTC plays a role only in what we call the commercial part of the Data Privacy Framework, so it only has a role with respect to enforcement of the privacy principles by companies in the US. It does not play any role whatsoever in the area of government access to personal data, which was the subject of previous litigation around the EU-US data transfer arrangements.
- Anne Schilmoller, Head of Sector for Data Flows and Judicial Cooperation at the European Commission
Asked whether we can expect a Schrems III case, Max Schrems shared a candid answer about his perspective on the matter, whether noyb would be able to pursue it at the moment, and the financial risks carrying such a case would involve:
We would be very confident in bringing this case. I just have to be honest, there is a capacity issue on our end because the Commission has put out the Omnibus (...). We are still very much determined to bring this case; the question is really a capacity issue on our end for a Schrems III.
- Max Schrems, privacy lawyer and chairperson of noyb
The group continued to discuss the intricacies and implications of Trump v. Slaughter, and where the decision could lead cross-Atlantic data transfers down the line. Watch the full recording for the complete conversation, and learn more about how you should get ready ahead of a potential fall of the DPF in our guide:
{{data-privacy-framework}}
The Digital Omnibus and what it could change for data protection in the EU
The second, and biggest, topic of the webinar was the Digital Omnibus, the GDPR simplification project led by the European Commission:
This specific omnibus is one of the twelve omnibuses proposed by the European Commission to date (and there is another one coming). The European Commission embarked on a large-scale exercise to review the whole EU acquis and see if we’re killing European businesses by regulation.
- Valda Beizitere, Legal and Policy Officer at the European Commission
With the stated objective of reducing consent fatigue and easing rules for both citizens and businesses, the Commission is looking at how to streamline “cookie rules”. During the webinar, the group focused on three areas:
- Cookie exemption: Amendments to the ePrivacy Directive would expand the instances of use without consent, including third-party audience measurement (pseudonymized, EMFA-compliant) and contextual advertising performance measurement (single session, no profiling, no data retention).
- Machine-readable/browser consent: Article 88b, which required data controllers to accept automated consent signals from browsers, was removed in the Commission's latest draft position.
- Pseudonymous data: Article 25a introduces a new definition in which data is considered personal only if the data controller can identify the data subject, rather than universally. This would fundamentally change how the GDPR's scope is determined.
On the timeline, the prospective final agreement could happen in 2028, with compliance deadlines over the following two years. Regardless, it is critical for companies to stay on top of this project, which we will continue to cover as it progresses through the legislative process.
For a primer on the simplification project, browse our guide to the EU Digital Omnibus:
{{learn-more-digital-omnibus}}
Access the full webinar replay
To watch the full conversation, head to the webinar recording available online:
