Europe’s Data Watchdog Moves to Curb Forced Online Accounts as Digital Omnibus Debate Intensifies

Key Takeaways

• Guest Checkout Should be Standard: The EDPB says online retailers should allow purchases without forcing account creation, limiting personal data collection.
• Mandatory Accounts Only in Narrow Cases: Subscription models and exclusive services may justify requiring an account, but only with proportionate data use.
• Caution on Digital Omnibus Reforms: Regulators worry proposed changes go beyond recent CJEU case law and could weaken data protection rights.
• Public Consultation Ahead: Stakeholders are invited to weigh in on both the account-creation guidance and Digital Omnibus discussions.
• New EDPB Leadership Confirmed: Jelena Virant Burnik, Slovenia’s Information Commissioner, has been elected Deputy Chair to support alignment across the EU.

Deep Dive

Europe’s top privacy regulator wants online shopping to come with fewer strings attached, specifically unnecessary user accounts. At its latest plenary session on Thursday, the European Data Protection Board (EDPB) adopted new recommendations urging e-commerce companies to let people shop without being pushed into creating accounts that vacuum up personal data.

The Board says most purchases should be possible in a straightforward “guest checkout” mode. Account creation, it notes, often triggers unnecessary data collection and exposes users to heightened privacy and security risks. The default should be choice, not a data-driven obligation.

Still, the EDPB isn’t ignoring real-world business models. Subscription services and exclusive membership programs are among the limited scenarios where requiring an account may be justified. Even then, the Board stresses the need to keep personal data collection proportionate and aligned with the General Data Protection Regulation's (GDPR) data protection by design principles.

The recommendations, which are now open for public consultation, represent a push to curb what regulators see as a creeping trend toward bundled data processing in everyday online shopping.

Early Warning Shots on the Digital Omnibus Proposal

The EDPB also turned its attention to the European Commission’s so-called Digital Omnibus, which is a proposal pitched as a way to streamline compliance with data rules and make GDPR obligations easier to navigate, especially for smaller organizations.

While supportive of the goal, the Board signaled that lawmakers may be over-stepping in key areas. The proposed update to the definition of personal data, for example, already appears to exceed what recent rulings from the Court of Justice of the EU have established, certainly a red flag where fundamental rights are concerned.

More analysis is coming as the EDPB and the European Data Protection Supervisor prepare a Joint Opinion, but the message for now is that simplification shouldn’t come at the cost of weakening privacy protections.

A broader discussion with stakeholders is set for 12 December during a public event in Brussels, another sign that the debate over how to fine-tune Europe’s digital rulebook is picking up pace.

Slovenia’s Jelena Virant Burnik Steps In

The plenary ended with a leadership shift. Jelena Virant Burnik, Slovenia’s Information Commissioner, was elected as the Board’s new Deputy Chair. She joins EDPB Chair Anu Talus and Deputy Chair Zdravko Vukić in steering Europe’s data protection priorities at a time of rapid regulatory and technological change.

Virant Burnik said she is eager to help strengthen cooperation among national data protection authorities and ensure consistent enforcement across the EU.

Talus praised the appointment, calling the landscape “fundamentally shifted” in recent years and emphasizing the importance of experienced leadership as the EDPB continues to shape Europe’s digital future.

With new guardrails for online shopping, major regulatory reforms under the microscope, and fresh leadership at the helm, the EDPB is signaling that consumer privacy isn’t taking a back seat any time soon.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.