They who must not be identified—distinguishing personal from non-personal data under the GDPR

In this article, we examine the concept of non-personal data from a law and computer science perspective. The delineation between personal data and non-personal data is of paramount importance to determine the GDPR’s scope of application. This exercise is, however, fraught with difficulty, also when it comes to de-personalized data—that is to say data that once was personal data but has been manipulated with the goal of turning it into anonymous data.

This article charts that the legal definition of anonymous data is subject to uncertainty. Indeed, the definitions adopted in the GDPR, by the Article 29 Working Party and by national supervisory authorities diverge significantly. Whereas the GDPR admits that there can be a remaining risk of identification even in relation to anonymous data, others have insisted that no such risk is acceptable.

After a review of the technical underpinnings of anonymization that is subsequently applied to two concrete case studies involving personal data used on blockchains, we conclude that there always remains a residual risk when anonymization is used. The concluding section links this conclusion to the more general notion of risk in the GDPR. One year after the European Union’s (EU) General Data Protection Regulation (hereafter ‘GDPR’ or ‘the Regulation’) became binding, uncertainty continues to surround the definition of some of its core concepts, including that of personal data.

Drawing a dividing line between personal data and non-personal data is, however, paramount to determine the scope of application of European data protection law. Whereas personal (including ‘pseudonymous’) data is subject to the Regulation, non-personal data is not. Determining whether a given data item qualifies as personal data is thus crucial, and increasingly burdensome as more data are being generated and shared.

Notwithstanding the pivotal importance of the distinction between personal and non-personal data, it can, in practice, be extremely burdensome to differentiate between both categories. This difficulty is anchored in both technical and legal factors. From a technical perspective, the increasing availability of data points as well as the continuing sophistication of data analysis algorithms and performant hardware makes it easier to link datasets and infer personal information from ostensibly non-personal data.

From a legal perspective, it is at present not obvious what the correct legal test is that should be applied to categorize data under the GDPR. Recital 26 GDPR announces that data is anonymous if it is ‘reasonably likely’ that it cannot be linked to an identified or identifiable natural person. National supervisory authorities and the Article 29 Working Party (the ‘A29WP’ is the European Data Protection however, of the concept that with this be that Recital 26 GDPR a test on the risk of the Working Party has a test that that there can be no remaining risk of identification data to as anonymous data. anonymization is an concept from the of and in European data protection such as that of data The of what a of identification the of the concept of data in the Regulation has some This article charts the from an perspective. the GDPR’s definition of personal and non-personal data from a computer science and legal by as the legal of personal and non-personal data are an analysis of the and its by supervisory we the technical on personal data to The section the in at of concluding section on in with the of the GDPR. be to what has been by anonymization is and that the legal definition to the remaining The GDPR to personal data, that non-personal data its scope of application.

The definition of personal data is an of as it whether an data is subject to the that the Regulation on data This that the definition of personal data is from being of the of the of personal and non-personal data are of to data. personal data is of the of in the data protection The Regulation a that between personal data and non-personal data and the to its scope of In with this legal perspective, on a between data that is data that is anonymous and in is from data that is not personal on its but can be personal if is in there is an as to whether and if under personal data can be manipulated to Indeed, some data can be anonymous data from the as data with no link to natural data at some be personal data but be manipulated to no to an identified or identifiable natural person. This that the of personal data is on the data can be personal or non-personal and be subject to the Regulation or not. This section of the definition of personal data. there is the legal test to be technical are this the of an legal of data in the GDPR has Article GDPR personal data information to an identified or identifiable natural an identifiable natural is can be or in by to an such as a an identification data, an or to or more to the or of that natural data is data that or to an identified or identifiable natural person.

The Article 29 Working Party has on the of the test in Article identified or and to be to be and information as a or the of a given in as well as analysis such as and The European of however, in the that information in the application a and data in legal analysis as personal data, legal analysis (the data can and be or data, and that Article GDPR to data, that the data to some the distinction between information and data is not always to Data is to be to a data subject it is that This information that is in an but also data that information the data is to be identified or identifiable can be from This not that the can be identified by a also be identified such as a This that the concept of personal data to be a that has been by the and in that the ‘the of the to a scope to that is not to information that is or but of not but also In the that as data or with on the identification of the data subject can be personal data as it makes it the of the with a or has and by what and to the of the as well as the from that Article GDPR that personal data to a natural person. The GDPR not to legal or the The has that the concept of personal data to be not data personal data. The European data protection two of personal and non-personal data. is data that is always non-personal it to an identified or identifiable natural and there is also data that once was personal but no is to a natural has been The legal test to differentiate between personal and non-personal data is in Recital 26 GDPR to data have be to a natural by the of information should be to be information on an identifiable natural person. determine whether a natural is should be of the to be such as by the or by to the natural or whether are to be used to the natural should be of such as the of and the of into the at the of the and Data not by this test the scope of European data protection law.

Indeed, Recital 26 GDPR on to The of data protection should not to anonymous information not to an identified or identifiable natural or to personal data anonymous in such a that the data subject is not or no to the GDPR data is personal when the or is to the data subject by the to be personal data to a natural or is no to be to a natural it qualifies as and the scope of application. the test to be applied to determine whether information personal data. The test by Recital 26 GDPR a to there is a risk of data to be as personal data. that risk is data can be as non-personal data, and this even identification cannot be with however, that some of the of this test from a of in from by supervisory of data under the GDPR Recital 26 GDPR to a to between personal and non-personal data, in practice, it has to This obvious when dividing the test in the GDPR into its Recital 26 GDPR a to determine whether data is personal in or not. identification is ‘reasonably likely’ to personal data is in this is not the case the information in is national supervisory authorities have of the GDPR that in line with this The a of Recital 26 GDPR, that the is ‘the identification or of a data This that ‘the risk of data is it can be with what data is or what data be in the The Data Protection that it is not to that it is the data subject to be identified in an to be if it can be that it is that a data subject be identified given the of the case and the of the data can be In its on anonymization and the Article 29 Working however, adopted a the the Working Party the the however, to its that from personal data in to the announces that is a applied to personal data in to This is in line with from to data is data to an identifiable but that identification is no This that ‘the of as a applied to personal data should in the of as as it to personal is the Working Party that a data not the data at and the data of this after or of identifiable the is personal This has been as there well be a to anonymous data to the as be the case a makes data the data This in is a of the as it the risk from the data to be and the of on and of Recital 26 GDPR is as the definition of to both identified and identifiable data the risk remains that data be as as the has not been even if the of has been the also that are to of such as has it is what to the of the GDPR, the Working Party thus to that no of risk can be Indeed, the of and a that by the Whereas Recital 26 that anonymization can be as the Working that anonymization to be have legal as to what test to be applied in The between the and the by Recital 26 GDPR can also be identified in by national the anonymization in that anonymization to be as to no the of personal This to is more as it that is the also that it can be to in the the national data can, however, be anonymous if the or identification of the and this whether from the of the data or a In the the that are personal data this is the The Data that the data to as anonymous be to Recital 26 GDPR, the to whether data is or anonymous is determine whether an can be identified to be given to to be This such as the of and the of into the at the of the and In the that to be to determine whether has if it is to an it is to link to an and information an can be the to is data can be should be that Recital 26 GDPR makes to and are by the Working Party but not in the GDPR. to ‘the to some or an in the the risk generated at two data information the data in such an can by of that two are to a of but cannot in this the used but not be even and are not. has been by the Working Party as ‘the to with the of an from the of a of The Working Party that is This is by its analysis of the used that a residual risk of identification if at a of can Recital 26 that the to be into are not that are but also is, however, from obvious what to be in this Recital 26 not whether to as a that has been but not to the data or or whether in should also be given a concrete it is not obvious whether the of should be in when whether a personal data into anonymous The that should both ‘the of the in at the of the as well as ‘the the the data be In to the the of the data is a Indeed, data is to be a the data that of identification that also the year of and personal data at that This that the data in personal information in the from the the be and that This the GDPR’s as a is in the concluding to the Working the be to to as and to the technical and in Indeed, the is that data personal data at the identification The to be whether a given can be with datasets from the of availability technical The risk that the in of the in the information in identification is not to data in the This has been as ‘the of data should also be an on the of the data of the data of the that has In in data continues to an have to a that on its is anonymous but or subsequently to a information that The data protection are it is a test this be as there is of what data be generated or in the such it be more to and that anonymous data personal data as as identification In data have a and technical and in determine whether information personal data, it is to from the of identification to be Recital 26 that to determine should be of the to be such as by the or by to the natural or This to that it is not to from the of the but also The GDPR is a and the has and the to an of the and protection of data From this perspective, it from data qualifies as personal should the data In the there has been a as to whether there is a to on the data or have the that the to ‘the risk it the data to always the even if are not to the supervisory authorities to have a test between the and The the test should determine whether an if to The is to be ‘reasonably and with to such as the or but should not be to have such as or to have to In the European is the case on this of the that information in This information the that with to the that the of the was in of The in that personal data to be Recital GDPR also as The that the and identification of was by the in the case at the and identification of the was by the of the of a that it makes to the the data in to is not data to an identified natural personal but can be to that to an identifiable the data are by the The as personal data even the data to was not by authorities but by the In this that the of data not to be from the of the the but also from the of (the the Indeed, is no that the information the identification of the data subject be in the of that have been by the at The that it is in under law the to such data to the has the to to in the of a This is also an as it that are that are ‘reasonably that the of to be applied is not the in Recital 26 GDPR as the the risk of The also an Indeed, the on the the of to the data to a de-personalized was to its This makes on the whether the of an that identification that it should always be as This to has been in as have in relation to that the personal data, such as a with the the data In the the that the of data to the is not a personal data the was not or the an a to that the of the legal it should not be that the that a can the law to to data to a natural that a to be The that the from to be is that of the data In General that if the it be to with there is no in of data be with that information and of a a there is a data a is but a be to at some of the from the information has that a data to the of data, this not that be of the data, have a as well as to the an the of anonymous data as there always be to a with information that is from the risk of identification to be Recital 26 that a of and should be to determine whether a natural can be is, however, an to be that what is a on The of data is that not be as a of the data but as a of the of the is to that to be on whether the is a or a law or a Whereas a is in it is not obvious what of to be whether the of a to be in or not. it is not whether an or to be of has to data that however, a including has to information in the present and to data in the The that it should be the be what the to be used also the of the personal data, as well as its to a or to the Indeed, when data is with the at there is a to anonymization as it is to once it that identification is this in it should be what data have to as but also data to a or This to that data to be to determine the of a this exercise to data as it be to with that there is not to anonymous data. The that when data is it is not to determine whether it is anonymous data from the of the the data but also whether there are that are to to as a that that an case to of This that what to be is the of that be to to data, the Indeed, an present as it of the a data data that is from its as cannot whether in the have information This is a in data the data be that it is anonymous cannot with whether be to data on the of that remains in this is thus from the of data to be from the of or of to of the information have to to a de-personalized the is the the what can be to of such information whether to be as a the that when the of personal data, it is to the by the data in the data Indeed, that are not the of is to be a in In the the supervisory that the of data by that it to is personal data as ‘the by the is to a of in an to the of In line with this or of used to a natural personal data.

After the general the of personal and anonymous data, it be that technical the legal of data. the of more performant data analysis and hardware as well as the availability of data it is increasingly to data to natural have that data protection law the of as in the data be personal data and thus subject to the This is as is of and in data and in increasingly information is to to a in or The in the that is increasingly to with the of computer and the availability of In of technical the risk of can be be used to of ‘the of datasets to the can be a to difficulty in the that it is not what datasets a given has or have to in the The to anonymization has been as and has the of such as an can be used to a data the of data the of is to data on the of computer have even that the of personal data is an has that anonymous datasets the identification of natural as as the the of and The of anonymous data has been as ‘the of a that the of a and that the scope of data protection however, is not the case even data that is anonymous on its be subsequently with data such of datasets to be anonymous the of data or the of data from a with data from a review that of the of a be a of In of the it be that the to anonymization in Recital 26 GDPR is the to between personal and non-personal data. Indeed, in data it can be that the anonymization of data is as Data and is data are and be in of information the data has no are in the between personal and non-personal data. The GDPR that when data is to this not in anonymous but in data.

Article GDPR as the of personal data in such a that the personal data can no be to a data subject the of that such information is and is subject to technical and to that the personal data are not to an identified or identifiable natural The concept of is of the of the GDPR to the Data Protection is an the of Article in whether the to a of data of personal and anonymous data. however, that Article GDPR with a not an of data is the of personal data in such a that data can be to a data subject with the of This that data remains personal data, in line with the Working that is not a of the of a with the of a data and is a data is and personal data, but its is as risk to data and as such is given to its The supervisory that be an of The GDPR as a can as of with the under Article GDPR and that the data protection by and by has been Recital that application of to personal data can the to the data and and to to Recital is the when that has technical and is to that Recital 29 this in to to when personal data can, however, be linked to natural Recital that data be with by and such as or identification when when with and information by the be used to of the natural and is that even data of as data, it be by Article GDPR, to the is not to or information to the data subject in to with the In such the not to with GDPR the data subject information identification the of GDPR is thus that as a it of being an anonymization the of data protection law the GDPR, there was some the legal distinction between and supervisory authorities that can anonymous has been that this be in the that in computer science are as and thus not anonymous In the GDPR is that data is personal data. however, the GDPR of as information to data. The a definition increasing it is also that Article GDPR be as that there is data the that the of a de-personalized this always to personal data. a data is to data by a that is de-personalized from a that even the of technical and makes the of that the of to whether this is in the case be the legal whether a of data is to be personal data or non-personal data under the GDPR, we on to the technical of anonymization and technical can be used to links to natural from data that the of in the and the of to also with to the of data points a or present of in the importance of to data, we with to the to be used are two points from when we have a and to data points to this from a of de-personalized data and from a de-personalized when we to the or data points have to between the relation between a and its and is an on the to this a the of and be the this the can be as on the the of a can between and of This is the of in of a data that or a of and with of with a and a that this to the This in the being into two datasets can be and a data be into data points in two to the data from the in to data Data in the is in line with Article GDPR, it no be to a data subject the of In such in some such as The is and in such to this can the data, that it can not as anonymous data at from the of the data to data. is Article GDPR is that it to that as as there is this is anonymous data, not the that there can be technical or identification not on whether we with a and to this was in or if we with a and to the of the In both what is is to the to this no is to to this data is personal data. to this with to and the what by two datasets and the that was some a to the on and to a of or to the by the and In practice, both in case of an data to or to the can also from to data that from a or The more of and algorithms that not an a between a being to a given and a of being to the from a This be used to some from a de-personalized The of this being can be in as it on the data. This an of the used by such as and what of to be an identification to be this is an in this it is also pivotal the relation between the GDPR and more of links to data from data is to of the data that by the of data. is the of a is a a of data of a given as or the always the a given of data.

The of always be The of always be can in be to however, the data cannot be from the are thus or this we an the In to the there is no the between a and the is by the This has of data no was can be or and the is can the of or even to the was from a thus to the of and the of a from data with given is The to that is the data subject the are to that be the the and whether the is a and to on with data, on de-personalized in and with in the the a on there are the and to the data are a an increasing of the of the of the of from a given on the and of the Working Party line with its not data anonymous of the of the an of whether such a is ‘reasonably in on can be in what and at what that we whether an or to identification be a and more points in the of of be and between a of more the be with such the more the is on more and thus in to such as or in more of and and thus when technical the in by a of a data be the a with technical such a of can be as ‘reasonably likely’ as as the as is are not or not a data subject when are used of also be This is the as it is by the that the the data such as or to data datasets that to also was at to more as it can be applied to a information to more and and also to a to datasets the to the of is in the case of it is in the case of a and the two and are used. and are two used in In both data is to the data the is but the data between that also The of is the of is and the data and its of data in a as a In the the is to it in as the is and the data (the not in the it also on of on a of as have to of by the the by the of as as the remains in data and the data to the of thus from that used the of the are with the not the but that two with the have thus that used by can be identified on the are used in in the of but also be the of This the as of item from the in have to be more more a the in the this on the that to a to be should be and it more with that be ‘reasonably likely’ with a to be and even more with the even more however, of to more with the that there are no between that the and the of the of and into relation with thus the of is with and and an the of with to a thus significantly. the relation between a and a have no on the of datasets from if are used. both a should thus not be the such and thus the of the of is not in be applied to to that the to This to in the it is not obvious that two the In such is not but it should be to that a was subject to a given a with or however, also the to be with data the data points be by the used a data it is to a by that was of a by the to the with the the also be used in with a as the and to the the of the is that it have to be data to be in the a to of the In the however, the of the of the links between data and data are