The conversation starter in Brussels this month has been: "What is the
plural of omnibus?" Omnibi, omnibuses and simply "two omnibus" have all
been used. Linguistics aside, November has been a big policy month. Two
omnibuses were presented. A GDPR simplification of record-keeping
obligations is proceeding through the parliament. Lastly, the long awaited
“Democracy Shield” was unveiled.
=== Two New Omnibuses ===
Last week the European Commission published two new omnibuses: One on the
AI Act
<https://digital-strategy.ec.europa.eu/en/library/digital-omnibus-ai-regulat…>,
and a general one
<https://digital-strategy.ec.europa.eu/en/library/digital-omnibus-regulation…>,
tacking a slate of digital rules. The stated intention is to simplify the
sometimes very complex EU rules. However, one major criticism is that the
proposals go further and fundamentally change the EU’s digital rulebook by
weakening long held principles like data protection.
—
The “general” omnibus is packed with amendments to the GDPR and to the
rules on re-use of open government data. The latter is currently spread
across various pieces of legislation (Data Governance Act, Data Act, Open
Data Directive). One suggested change is to move all relevant articles to
the Data Act.. Another change is to allow public sector bodies to charge
specifically very large enterprises to charge for data re-use. This is
politically not very surprising. The challenge is that, if implemented,
such specific licensing provisions would be incompatible with the open
definition and free licenses used by Wikimedia projects. The details will
be important here.
—
More consequential are the various changes proposed to the GDPR and the
ePrivacy Directive. The draft tries to tackle so-called “cookie banner
fatigue” by introducing several broad exceptions that will allow services
to gather and use device data without asking. It also prohibits services
from asking for consent a second time within six months, if they were
already denied by the user.
—
A seemingly positive idea is to introduce a so-called “privacy signal” to
browsers. Users would set privacy preferences in their browsers once and
these would then be communicated automatically when opening a web site,
signalling consent or denial. Another provision would require data breaches
to be notified only to the authority in the place of establishment.
Currently such breaches must be reported to several, sometimes even all,
authorities.
—
The most contentious parts of the GDPR proposals are about redefining the
definitions of personal and pseudonymised data. The changes would also make
the re-use of personal data for AI training easier by categorising it as
“legitimate interest”. Weirdly, this would lower the threshold for AI
training much lower than other everyday uses.
—
At Wikimedia Europe we are still analysing the texts and have the ambition
to share this analysis and a potential position in the coming weeks.
=== Democracy Shield ===
On November 12, the Commission published the European Democracy Shield
<https://commission.europa.eu/document/2539eb53-9485-4199-bfdc-97166893ff45_…>.
It is a non binding communication, identifying a whole range of measures
that should protect EU democracy, focusing on three main areas:
1) the safeguard of information space;
2) the strengthening of democratic institutions, free and fair elections
and free and independent media;
3) boosting societal resilience and citizens’ engagement.
—
Among the most relevant measures are the setting up of the European Centre
for Democratic resilience, the full implementation of the current
legislation (DSA, EMFA) as well as a revision of the anti-SLAPP
recommendation
<https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022H0758>
from 2022. There is also an explicit mention of the review of the Copyright
Directive to address the challenges posed by generative AI.
=== AVMSD Review Consultation ===
The Audiovisual Media Services Directive regulates media services. However
the differences between traditional media services and online video-sharing
services are melting away and the EU is likely to update this piece of
legislation.
—
The Commission opened a call for evidence
<https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/1…>
to kick off its revision process. The next step will be the launch of an
open consultation and the publication of the report by December 2026.
—
Relevant issues for us to monitor are which platforms get defined as video
sharing or streaming services. Currently Wikimedia Commons is not in scope.
Video sharing or streaming services have certain obligations , such as
carrying European content and age verification. All these will be
re-discussed.
=== GDPR Simplification ===
Since May a legislative proposal
<https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025/0130(…>
to reduce the record-keeping obligations on SMEs has been making its way
through the process. It includes changes to the GDPR. Most notably, the
European Commission suggests that organisations with fewer than 750
employees should have fewer obligations, as long as the processing is not
high risk. This would benefit the Wikimedia Foundation, which is currently
around 700.
—
The European Parliament committees now further voted to increase the
threshold to 1500 (see Amendment 3
<https://www.europarl.europa.eu/doceo/document/CJ58-PR-775772_EN.pdf>).
Another amendment (AM 4), specifies that the derogation is for a given
processing activity. Meaning that if an organisation performs both
high-risk processing and non-high-risk processing activities, the
derogation will still apply to the latter.
=== CSA ===
This week the Council finally agreed
<https://www.consilium.europa.eu/en/press/press-releases/2025/11/26/child-se…>
on a negotiating mandate
<https://data.consilium.europa.eu/doc/document/ST-15318-2025-INIT/en/pdf>
on the CSAM Regulation, three years after the original proposal.
—
The deadlock was broken by Denmark and other hawkish countries giving up on
forcing messaging services to scan for CSA material. A measure that would
break end-to-end encryption. The mandate, however, still allows services to
voluntarily scan messages. It also includes a review clause that mandates
the Commission to check in three years if the state of hash scanning
technology has developed and further changes are needed.
—
The Council must now negotiate with the European Parliament, whose own
position
<https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2022/0155(…>
has also removed the mandatory chat scanning provision. They are expected
to reach a decision by April this year. Else the currently permitted
voluntary scanning will become illegal. It is now ensured by a stopgap law,
which expires in 2026.
== Franco-German Digital Summit ===
On 18 November Germany and France organised
<https://www.elysee.fr/en/emmanuel-macron/2025/11/18/summit-on-european-digi…>
a Summit on European Digital Sovereignty in Berlin. Politically it was an
effort for the two EU heavyweights to align on several ideas and drive the
continent forward. Germany is traditionally very cautious on “sovereignty”
issues, but that is shifting. France is currently in an extremely weak
position not being able to form stable governments.
—
Ahead of the summit an open letter
<https://wikimedia.brussels/open-letter-harnessing-open-source-ai-to-advance…>
with concrete demands regarding open source and public interested AI was
circulated. It was co-signed, among others, by WMFR, WMDE and WMEU.
Wikimedia Deutschland was also represented at the event.
—
The authors of this newsletter struggle to point to concrete and palpable
outputs.
== DSA Reports ===
Last week the European Commission released two interesting reports
regarding the Digital Services Act, Europe’s content moderation rulebook.
—
The first one looks at the overlaps
<https://digital-strategy.ec.europa.eu/en/library/report-application-article…>
between the DSA and other legislation. Elements of it will likely find
their way into a DSA evaluation that the Commission needs to finalise
before November 2027. It might also influence potential future legislative
(simplification) proposals.
—
The second report looks at the risk assessments, mitigation measures and
audits performed by Very Large Online Platforms
<https://digital-strategy.ec.europa.eu/en/news/digital-services-act-report-l…>
(including Wikipedia’s) and tries to provide something like a meta-analysis
for systemic risks in the EU.
== Child Protection INI ===
The European Parliament adopted a de facto resolution
<https://www.europarl.europa.eu/news/en/press-room/20251120IPR31496/children…>
(a non-binding own-initiative report) that calls for an age limit of 16
years for social media use. It also asks for the possibility for children
to access social media if parental consent is given. If this turns into an
actual legislative proposal by the Commission it would be crucial that
Wikimedia projects are not defined as social media.
--
Wikimedia Europe ivzw
Hi everyone,
Many of you know that RightsCon, the world's largest digital rights
conference, is coming to Lusaka, Zambia in May 2026.
Travel scholarships (full details here
<https://www.rightscon.org/rc26-travel-support/>): The deadline to apply
for travel support is January 5, 2026 at 23:59 Pacific Standard Time, and
decisions will be communicated to applicants by the end of January 2026.
The email below contains more information about eligibility and the
application process.
*Why attend RightsCon: *Whether or not you submitted a session, I highly
encourage you to apply for a travel scholarship. RightsCon is a vibrant,
dynamic, and relaxed space for digital rights activists, researchers,
technologists, and journalists to connect and share their work. You can
read more about how Wikimedians have participated here
<https://diff.wikimedia.org/?s=rightscon>.
Best,
Ziski
---------- Forwarded message ---------
From: Daphne Ugarte, Access Now <rightscon(a)accessnow.org>
Date: Mon, Nov 3, 2025 at 5:01 PM
Subject: Start planning your RightsCon 2026 participation
To: <fputz(a)wikimedia.org>
[image: Start to plan your travel to Zambia]
<https://www.rightscon.org/plan-your-travel/>
Hi Franziska,
With registration launching later this week, it's time to start planning
your travel if you want to join us in person for *RightsCon 2026
<https://www.rightscon.org/> (May 5–8, Lusaka, Zambia, and online)*
We’re excited to launch the first phase of our *Plan Your Travel*
<https://www.rightscon.org/plan-your-travel/> page, your go-to resource for
everything you need to know to travel to Lusaka, including:
• Preliminary *visa information* and our key recommendations
• *Flights* and airport arrival details
• *Accommodations*
• *Safety* *guidance* for participants
• A timeline of *key dates* to remember
Visit the Plan Your Travel page
<https://www.rightscon.org/plan-your-travel/>
As part of this launch, we’re also opening *applications for travel support
<https://rightscon.secure-platform.com/a/solicitations/62/home> *through
our Community Support Fund, which helps ensure our summit remains
accessible to underrepresented voices in our community who might not
otherwise be able to participate.
While *our resources are limited as an NGO*, we’ll continue to prioritize
participants directly involved in the program, like *session organizers,
speakers, and facilitators*.
You can learn more about our approach to the Fund this year in our *blog
post* <https://www.rightscon.org/rc26-travel-support/>. For details on
*eligibility
requirements and the kinds of support we offer,* visit *our website*
<https://www.rightscon.org/plan-your-travel/#csf>.
Talk to you soon,
Daphne, Nikki, and the RightsCon team
[image: LinkedIn] <https://www.linkedin.com/company/rightscon> [image:
twitter] <https://twitter.com/rightscon> [image: Instagram]
<https://www.instagram.com/rightscon/>
Stay connected with the RightsCon <https://www.rightscon.org> community on
social media for all the latest updates.
[image: LinkedIn] <https://www.linkedin.com/company/access-now> [image:
Twitter] <https://twitter.com/accessnow> [image: Instagram]
<https://www.instagram.com/accessnow/>
Follow Access Now <https://www.accessnow.org/> for more opportunities to
join the fight for human rights in the digital age.
You are receiving this email because you have registered for updates about
RightsCon. If you do not wish to receive these emails, click here to
unsubscribe.
<https://act.accessnow.org/page/email/subscribe?campaignpageurl=https%3A%2F%…>
For
support on anything related to RightsCon, please contact us at
rightscon(a)accessnow.org. This newsletter is sourced globally and published
out of our U.S. location.
Proudly hosted by Access Now | We defend and extend the digital rights of
people and communities at risk
https://www.accessnow.org | Access Now, 180 E Prospect Ave #189,
Mamaroneck, NY 10543
[image: supporter]
Hi all,
This is just a reminder that tomorrow (4 November) there will be an *online
Child Safety Training for Wikimedians
<https://meta.wikimedia.org/wiki/Wikimedia_Europe/Advocacy/Child_Safety_Trai…>*.
It will take place online, registrations
<https://docs.google.com/forms/d/e/1FAIpQLSegC5G8LNiq4lGQXmXy3aO6GlccRBDOZQH…>
are
still open.
It is mostly intended for project editors and users, with or without
extended rights. It will focus on the online experience, not on in-person
events. The basic idea is to provide necessary knowledge on specific
threats, assessing situations and deciding on reactions.
Best,
Dimi
--
Wikimedia Europe ivzw