Pseudonymisation: a recognised tool to protect data processing

Executive summary 

We welcome the European Data Protection Board’s (EDPB) draft guidelines on pseudonymisation, and their stated objective to ‘help controllers to choose effective techniques.’ Today, pseudonymisation is widely used to minimise privacy and security risks around data sharing, notably to develop artificial intelligence (AI) tools or for research and innovation in different sectors.  However, the EDPB risks missing the mark on daily operational complexities for controllers, for example where pseudonymised and anonymised data intersect.  

It is key to recognise pseudonymisation as a practical and effective tool to apply privacy by design and by default principles, all the more so given upcoming proposals by the Commission to increase the availability of high-quality data. We therefore recommend that the final guidelines:  

• Introduce more flexibility in newly proposed definitions such as ‘domains’ or ‘additional information,’ and map references in legislation adopted since the GDPR; 

• In line with case law from the Court of Justice of the European Union (CJEU), clarify the conditions for pseudonymised data to be considered to have been anonymised; 

• Re-affirm the key role of pseudonymisation in international data transfers, and remove any additional obligations to Chapter V GDPR; and 

• Recognise and promote the role of privacy enhancing technologies (PETs) in facilitating effective pseudonymisation.