Open Letter

We, the undersigned researchers, write with urgent concern about the proposed GDPR Omnibus amendment to Article 12(5) proposed as part of Amendments to Regulation (EU) 2016/679 (GDPR) published on 19.11.2025. This seemingly technical change would make data donation research impossible. While access to platform data as set out in Art. 40 of the Digital Services Act (DSA) is on its way to become functional, data donations are one of the very few access modalities to study the impact of digital platforms in the European Union and beyond.

The proposed amendment allows controllers to refuse access requests based on Article 15 GDPR if “the data subject abuses the rights conferred by this regulation for purposes other than the protection of their data.”

This language directly threatens independent academic research using data donations. Data donations are a key method that require individuals to exercise their Article 15 rights to access their data and voluntarily donate it to researchers. Data donations are an essential access mechanism for studying the usage and effects of digital technologies and to assess systemic risks posed by digital platforms:

• Digital Well-Being of Minors (Verbeij, 2024)
• Unhealthy/addictive behavior on platforms (Yang et al., 2025)
• Binge watching behavior (van Es & Nguyen, 2025)
• Content Exposure and User Behaviour on Social Networks (Breuer et al., 2022, Bechmann et al., 2025, Koltai et al., 2025)
• Political polarization (Chen et al., 2025)
• Algorithmic Pay and Pricing on Gig Work Platforms (Binns et al., 2025)
• Health of Older Citizens (Keusch et al., 2025)
• Engagement with virtual assistants (Wald et al., 2025)

Thus, data donations are not just a prime example for participatory knowledge generation essential for democratic governance of digital ecosystems, they also empower European citizens through citizen science projects by informing them about and enabling them to make use of their rights as data subjects. The right to data access is one of the most visible examples for citizens on how European legislation benefits their user rights, strengthened through the work of the research community. 

Shifting the Default, Disabling Access

The proposed amendment would allow data controllers to deny data subjects their right of access, based on the argument that requests for research falls under “purposes other than data protection.” Even if this reasoning would be invalid, citizens would have to bear the burden of time-consuming complaints to under-resourced enforcement bodies or expensive legal challenges. Moreover, European researchers have been leading the development and use of data donations as a successful model of independent platform research—now followed by many countries—and restricting it would not only force them back into dependence on academia-industry relationships (e.g., Wagner, 2023), but also place them at a disadvantage compared to US researchers, who often gain platform data access through direct contacts.

Current data donation studies already face issues with platform-non compliance (Hase et al., 2024). Amending Art. 12(5) GDPR without making clear exemptions for academic research would further legitimise obstructive practices and make contestation of refusals for research projects impossible – effectively disabling data donation as a methodology by giving controllers veto power over research. Concerns about AI-driven spam requests can be met by proportionate technical measures to verify access for legitimate requests from citizens, and do not require amendments to the legal text.

Contradicting EU Online Safety and Research Policy

Finally, the suggested amendments contradict existing EU policies on both research priorities and data access. By lowering the likelihood of successful access requests, they close one important avenue for citizen science, a key part of the Code of Practice on citizen engagement for knowledge valorisation and European Research Area Policy Agenda 2025-2027. Also, while Art. 40 DSA grants researchers the right to access data from Very Large Online Platforms or Search Engines (VLOPSEs), Art. 15 GDPR applies to all data controllers. It thereby allows research on non-VLOPS and other forms of systemic risk not covered by Art. 34 DSA, such as consumer risks as well as general, fundamental research. Data donations have also been used to assess the quality of data received through the platform APIs (Entrena-Serrano et al., 2025). They thus not only serve an important role in risk assessment for non-VLOPs but also offer an alternative access mechanism essential for triangulation and validation.

Considering that the DSA’s data access provisions are still not fully developed (Seiling et al., 2025), this part of the GDPR Omnibus would eliminate this crucial access modality to platform data precisely when DSA implementation faces its greatest challenges.

Data Donation Research Must Be Protected

Data donation research puts power in the hands of citizens. It allows them to independently see what platforms know about them, contribute to public knowledge, and hold powerful corporations accountable. Often, it is research that makes platform data comprehensible for citizens (Welbers et al. 2024). It also enables research to fulfil an essential democratic function examining the digital ecosystem and providing relevant insights for evidence-based policy-making.

The GDPR Omnibus, as drafted, would transfer that power back to platforms, giving them legal grounds to refuse requests from citizens engaging in participatory research. 

This proposal directly threatens scientific freedom, democratic accountability, and the EU’s credibility as a global leader in digital rights. It may make it effectively impossible for Europeans to collectively understand the algorithmic systems shaping their lives, their children’s wellbeing, and their democracies.

Administrative efficiency cannot justify undermining democratic accountability and scientific freedom. True innovation thrives on transparency and evidence, not on shielding incumbents from scrutiny. This amendment would protect platform opacity at the expense of the research, policy insights, and informed citizenry that genuine European competitiveness requires.

We urge you to protect data donation research and to reject the proposed GDPR Omnibus amendment to Article 12(5).