Possibly the most useless legal provision ever proposed? Re-reading it doesn’t diminish my surprise at the proposed Article 29a of the GDPR, suggested in the draft EU Council compromise, which would say the following:
– “Controllers and processors may apply pseudonymisation to personal data in order to reduce the risks to the data subjects concerned and to help meet their obligations under this Regulation
=> Yes, thank you. This was actually already possible under the initial version of the GDPR (truly!).
– “Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information, should be considered to be information on an identifiable natural person. To determine whether natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller, the processor or by another person to identify the natural person directly or indirectly.
=> While Recitals (such as Recital 26, whose text is copied here) do not have the same legal value as Articles, we already have quite a bit of case law on this today, so not much added value here.
– “The Board shall: issue an opinion, in accordance with Article 64(2) of this Regulation, addressing the application of pseudonymisation and anonymisation, including related technical and organisational measures, and specifying means and criteria to determine whether the application of pseudonymisation to personal data may effectively prevent persons other than the controller from identifying a data subject, in such a way that, for them, the data subject is not or is no longer identifiable.
=> Given that this is already possible, I’m surprised this legal provision is required.
– “The Chair of the Board shall request the opinion referred to in paragraph 1 no later than 12 months after the entry into force of this Regulation. The opinion shall be reviewed and updated where necessary
=> Given that the EDPB is already working on Guidelines on Pseudonymisation, I guess this obligation to request an Opinion will be *very* tough to comply with. Or maybe not.
***
As I mentioned in my previous post, there are some good things in this draft, some bad, but this is most likely the provision with the least utility.
For more on the draft EU Council compromise text, to be discussed by the Council tomorrow: https://lnkd.in/ebtz832F
Did this analysis get you thinking? Reach out!
DataLaws.net is entirely open-access, and instead of getting your data in exchange for this content, how about another trade? If this commentary saved you research time or sparked an idea, feel free to invite me over for tea, chai or a hot chocolate next time you are around Brussels or Antwerp - or invite me over to your offices for a chat!
Get in touch ↗ Let's connect on LinkedIn ↗