New EDPB guidelines on pseudonymization

These guidelines provide both legal and technical frameworks and emphasize pseudonymization as an effective measure for protecting personal data. The guidelines are open for consultation until February 28, 2025. Organizations and experts are encouraged to provide feedback.

The draft guidelines could have significant implications for how parties process (or have processed) personal data for primary and secondary purposes. Until now, there appeared to be consensus that pseudonymous data for one party could be anonymous data for a third party if it is not reasonably possible for the latter (in terms of time, cost, and effort) to identify natural persons (see also Recital 26 of the GDPR). Although separate guidelines on anonymization are also expected, the current draft guidelines on pseudonymization may be a precursor to an overly restrictive approach to anonymization.

What is pseudonymization and why is it important?

Pseudonymization is a technique in which identifying elements of personal data are replaced with unique codes. This makes it more difficult to trace the data back to a specific person without additional information. While pseudonymization does not guarantee full anonymity, it does reduce the impact of data breaches and enhances data security.

The new guidelines emphasize that pseudonymization is not just a security measure but also a tool that can strengthen the legal basis of "legitimate interest." Companies applying pseudonymization can demonstrate that they are taking extra measures to protect individuals' privacy. The guidelines make it clear that pseudonymization constitutes the processing of personal data and therefore falls under the GDPR. This means that organizations must properly secure pseudonymized data and implement appropriate technical and organizational measures. Examples include encryption and access restrictions for the additional information required to link the data back to the original records.

The guidelines highlight the distinction between pseudonymization and anonymization. With pseudonymization, it remains possible to trace data back to an individual, whereas with anonymization, all identification possibilities are completely removed. This distinction is crucial, as only anonymous data falls outside the scope of the GDPR.

Technical and legal aspects

The guidelines discuss technical measures to prevent unauthorized data linkages, such as using cryptography, hashing, and strict access control. Hashing is mentioned as a method where data is converted into unique hash values that are difficult to reverse-engineer. However, the EDPB stresses that hashed data, depending on the context, may still be considered personal data. Risks such as brute-force attacks or the availability of supplementary information must be carefully mitigated.

The guidelines also include an annex with ten practical examples. These examples cover pseudonymization applications in medical data for scientific research, customer data analysis in marketing without profiling, and data security in clinical trials. This makes the guidelines relevant for various sectors.

More restrictive than established CJEU case law?

Regarding the concept of “personal data,” the EDPB’s approach seems more restrictive than that of the Court of Justice of the European Union (CJEU). Many experts hope that the Court will provide greater clarity on the status of pseudonymized data in the ongoing SRB case and how such data should be treated when transferred to third parties. The timing of these guidelines is also notable, as the CJEU is about to rule on this crucial case, in which its sister organization, the European Data Protection Supervisor (EDPS), is also involved.

The SRB case revolves around the question of when data can no longer be considered personal data under the GDPR. In 2023, the General Court of the European Union reviewed a dispute in which the Single Resolution Board (SRB) engaged Deloitte in a consultation process with creditors and shareholders of Banco Popular. During this process, the SRB shared pseudonymized data with Deloitte, which could not be traced back to specific individuals. The key question is whether these data, in Deloitte’s hands, still qualify as personal data if Deloitte cannot reasonably identify natural persons.

The General Court ruled that data can only be considered anonymous if it is legally and practically impossible to trace them back to individuals, even when pseudonymized. This judgment is significant for the interpretation of pseudonymization, particularly in cases where data is shared with third parties. The case thus highlights the tension between pseudonymization and anonymity, and the Court must now decide whether this interpretation holds and whether it aligns with previous rulings such as Breyer and subsequent judgments.

Advocate General Spielmann’s opinion: a more nuanced approach?

Advocate General (AG) Spielmann’s opinion on the SRB case provides a more nuanced interpretation that diverges from the approach taken by the EDPS and EDPB. He challenges the assumption that pseudonymized data automatically retains its classification as personal data in all circumstances, arguing that context matters when determining whether data remains identifiable.

AG Spielmann is particularly critical of an overly strict interpretation of personal data, stating that imposing data protection obligations on an entity that cannot reasonably identify the data subjects would be disproportionate. He emphasizes that pseudonymization can, under certain conditions, result in data becoming effectively anonymous in the hands of a third party, provided that the recipient lacks the legal or technical means to re-identify the individuals.

In his reasoning, the AG refers to the precedent set in Breyer, reinforcing the idea that identifiability is not an absolute concept but must be assessed in relation to the means available to the recipient of the data. If Deloitte could not reasonably access the additional information necessary for identification, then the data should not be considered personal data in its hands.

Spielmann’s opinion also touches on the transparency obligations of the primary data controller (SRB), suggesting that the EDPS was correct in asserting that the SRB should have disclosed Deloitte as a data recipient. However, he argues that the core issue is not merely whether pseudonymized data was transferred but whether Deloitte had the ability to re-identify individuals. He ultimately rejects the EDPS’s claim that pseudonymization alone should trigger automatic GDPR obligations in every case.

This perspective stands in contrast with the EDPB’s new guidelines, which take a stricter stance by suggesting that pseudonymized data should generally be treated as personal data even when transferred to third parties. Spielmann’s view, however, aligns more closely with previous CJEU case law, suggesting that pseudonymization, when robustly implemented, may lead to anonymization for the recipient in certain cases.

Differences from the UK approach

A key point in the guidelines is that pseudonymized data is still considered personal data under the GDPR, depending on the context. This differs from the approach in the United Kingdom, where pseudonymized data can, under certain conditions, be considered anonymous, as outlined in the Common Services Agency v. Scottish Information Commissioner case. In this case, it was ruled that when it is impossible for the recipient of pseudonymized data to identify individuals, the information does not qualify as "personal data." This aligns with guidance from the UK Information Commissioner's Office (ICO), which is shorter and more accessible than the EDPB's guidelines. According to the ICO, such data can be considered anonymous for the receiving party, depending on their ability to trace the data back to individuals. This concept is also referred to as "effectively anonymous."

Conclusion

The new EDPB guidelines provide valuable insights for organizations seeking to use pseudonymization to better protect personal data and ensure GDPR compliance. However, the question remains whether these guidelines align with established CJEU case law. The guidelines are open for consultation until February 28, 2025, and organizations and experts are encouraged to provide feedback.