Identifiability, as a data risk: is a uniform approach to anonymisation about to emerge in the EU?

Stalla-Bourdillon, Sophie (2025) Identifiability, as a data risk: is a uniform approach to anonymisation about to emerge in the EU? European Journal of Risk Regulation.

Record type: Article

Abstract

The concept of identifiability remains a foundational yet contentious criterion in European Union data protection law.This paper examines recent developments that have shaped the European Union (EU)’s approaches to identifiability and anonymisation, including trends in the Court of Justice of the European Union (CJEU) case law, national supervisory authorities’ assessments of anonymisation processes, and the recent European Data Protection Board Opinion 28/2024 addressing the anonymity of artificial intelligence models.The paper explores how the balance between over-inclusiveness and under-inclusiveness is being calibrated, suggesting the emergence of a functional definition of personal data in CJEU case law. It underscores the importance of the burden of proof in evaluating anonymisation processes, as confirmed by national supervisory authorities’ assessments. Finally, it highlights how to ensure consistency between the GDPR and data sharing mandates stemming from the new generation of EU data regulations.

Text

ssrn-5118064 - Accepted Manuscript

Available under License Creative Commons Attribution.

Download (420kB)