From knowing by name to targeting: the meaning of identification under the GDPR

Despite its core role in the EU system of data protection, the meaning of identification remains unclear in data protection law and scholarship while the spotlight focuses on the legally relevant chance of identification, ie identifiability. While Article 29 Working Party interpreted identification broadly, as distinguishing one in a group, this interpretation has been questioned in light of the CJEU decision in Breyer. This article tackles this uncertainty.

This article offers an integrated socio-technical typology of identification where, in addition to the known identification types (look-up-, recognition-, session- and classification identification), targeting is added as a new identification type. To identify by way of targeting means to select a particular individual from a group as an object of attention or treatment in a single moment of time. The article clarifies the legal meaning of identification under the GDPR.

It proposes a contextual interpretation of Breyer, which negates Breyer’s restrictive potential and brings all identification types within the GDPR. The article concludes with a discussion of the implications of this reading of identification for data protection in terms the applicability of the GDPR to new data technologies and practices such as facial detection and non-tracking based targeted advertising, effects of certain privacy preserving technologies such as federated learning of cohorts, consequences for invoking data protection rights when identification is not possible, but also in terms of the need to clearly define the objectives of the data protection law. Identification, referring both to the process of identifying someone and the fact of being identified, is one of the boundary concepts of data protection law.

It separates the data that is personal, i.e. relating to an identified or identifiable natural person, from non-personal, and thus triggers the applicability of the EU General Data Protection Regulation (the GDPR).1 Yet, despite the high stakes attached to the meaning of this concept, relatively little attention is paid both in law and legal scholarship to what identification is. Therefore the chief issue tackled here is the meaning of identification under the GDPR.2 The primary focus of the current scholarly attention lies on the adjacent concept of identifiability which refers to the possibility of identification, ie of being identified, in future.3 This is not surprising since in practice whether or not a person is identifiable rather than identified is regarded as an easier criterion to meet and is therefore a de facto ‘threshold condition’ when determining the of data as legal the meaning and legally relevant of and meaning and possibility of The and and the of of data protection law and to for of the data protection and as such and Yet, the meaning of identifiability is from and is in to the primary concept of Therefore identifiability is of being when not with a of It little to a natural person is when is not when a natural person and what means to identify the technologies to a person and the of data protection, the meaning of identification and the in what means to identify and to relatively of such is detection and in with facial facial to facial to a person is detection and not but in of and based on of facial to The that and the that facial detection not the chance of a person the is to this is to the of the data of an individual by the detection is The not a person and or To as from not legal and is that data in the interpretation of identification is Yet, is on the of detection and data protection the EU the data protection detection in the of as of while its and of the and to in facial and such as for or in the for or in with but also in the of and in of the data While the applicability of the GDPR the focus of in the also the applicability of the GDPR is not in in the of invoking data protection Article data from with data data and for and of as as data is to that is not in a to identify the data The what to The of data in Article GDPR and in Article GDPR also on the meaning of To been in the data protection legal in identification identifiability. a classification of to is to identification than and need to identification to the privacy classification and to the on the meaning of identification is by the meaning of an natural in the of and the of the meaning of as a for the meaning of while the meaning of identification in data protection with a to the privacy rather than to an interpretation of the legal concept of the EU data protection in light of the law of the and is to the legal of data in the of facial the meaning of identification under the GDPR but when the of is a of and on the concepts of and To a in a typology of what which is the of and to types of legal to or that not to or and of the meaning and of in the as of of the meaning and of and in the of and this the legal scholarly of the meaning of identification is This of by the fact that the Article 29 Working an EU on data protection under the Data Protection what an identified person means in its on the concept of a natural person as within a group of or is from all of the The for the concept of data in the since the of data under the and the This identification by but also of in on a and The of the Working Party when to the data protection on the is and its on the concept of data is the and for the as to this concept in The of the meaning of identification under the GDPR from the interpretation is thus that is and to the and of the data the meaning of identification as distinguishing a person from a group the of targeted advertising, and the of a person is of to the of the GDPR. for this the data protection scholarship to with the in law and the has been on The of the Working and the to identification, not The of of the the with to issue of the on the meaning of While the the Working Party in the and of the concept of data in also has a of not the of interpretation by the To the in its to the of identification as distinguishing or being from a group, by the Working Party and the GDPR protection a the meaning of identification, the in a as an to identify a while one of the core of an is to one or a on the from This to the interpretation of identification under the GDPR to the identification by or a the meaning of identification This and and with a of and but also not individual and of the new technologies such as facial of the of the data protection and by practices of legal protection that the GDPR the identification interpreted The scholarly on the has this and of the CJEU from the the identification under the GDPR This article this in the meaning of identification of the legal (the and to of the It an integrated typology of identification as a process and of distinguishing a person in a The typology on socio-technical of identifiability types by types of by and as by addition to the identify targeting as a new identification to identify by way of targeting means to select a particular individual from a group as an object of attention or treatment in a single moment of time. The on the on in and focus on the legal meaning of identification under the GDPR. a that all identification types not to identification by the GDPR meaning of It is an to one a interpretation of Article 29 Working Party that to identify means to one in a This in the Article 29 Working Party of the the of in the CJEU law with to the meaning of identification, and its restrictive a contextual interpretation of in light of the of the which negates Breyer’s restrictive potential and brings all types of identification, within the meaning of identification under the GDPR.

The This for Data with a discussion of the implications of this reading of identification for EU data protection law practice and or meaning of concepts a of in to the and objectives and system of the of identification means or process of identifying someone or or the fact of being and to identify means or or what or is or refers to or of someone or The is a of from and single to the in EU of the GDPR a a person is identified when is or when or is from being known or from or when that person is as a individual or in addition to the and socio-technical of what identification is. of the of this of the meaning of the types of identification by the types of by and the of as identification as by and what of identification, i.e. practices that identification is on the of identification as the process or fact of being or within a of the identifiability and types of classification and The identification is an identification of a individual by an such as a or and an when is a or a that that to a individual an an individual in the the identification refers to the identification of an individual a to and or of an individual is identified from being known or by certain ie an or of known or as by the to the the a a the to the as or or as being to to a in in the is an of is to a facial a with that to that individual a of a or has to a facial is as a of the need to an with one individual and of and of and is one is not and is a for and targeted of the classification identification, as of a particular group of The is not to an or or but to an individual as a of one or While is and of or also this a of the and of the that an individual in one or of is detection to of and an of classification not on and or identification to an individual a particular and the of the is to the of that is that an to a the the in a a typology of identification (the of that as to types of also of legal that to legal that to of and of by a a that is in a one is to a particular of and to the or and a of a as of an individual by an or in the a of in the While not of an or a the to a person and or in a certain or or by that to legal or ie that to the or identification a which as a to a preserving or but of by means of that to of refers to the identification by or the to a person, to or to the fact that the is such as the by or by identification by to a of or not to the or the of a that someone on the as someone a by a of a by a of by since of identified by and which not the individual from by of the of such as of a such as a or a or a to a particular for a or a for system While not the meaning of identification on the meaning and of is of for of and the and therefore the of concepts of in an that the of has been to ie to that when one in a certain one on or While the way to this in the to of to or from or has and or in of a such as a or a is to The current of data not to one its on someone to the of that person with a the of what is to to to is with This as identification as the process or the fact of someone being The of this is a for an integrated socio-technical of The to which practices identification in The This and also on identification as a person, to the meaning of identification The a new of identification not ie The on identification with and an of identification in with its as a process or fact of or distinguishing The typology by is to a of an integrated of identification to that by The typology by is as a typology of as not the meaning but the of identifiability as a identification rather than of identification as a fact or a a is not a identification and identification by as the of identification while the types to to of identifiability. typology is i.e. focuses on the of but also a that typology not To one not for the of as the types identified by under one and under of the types by in and and of types of identification by identification identification by a legal within identification, identification by under is to classification Yet, of types of identification types to identification by a that to and both under the and The is the a to to a and from that by a This that person identifiable in the of a or as a when to a a is the with the both the and as to and with where, possible, the of a person in the is not for the targeted identification by of both under and classification the of this of identification is the for a particular both by and when certain treatment is by a or a person as or to a based on facial and when the treatment is by a person of a or of high of by not to or both under and session- identification, on the of the the and in light of of identification that as a type. Yet, this identification is in the of identification as and distinguishing one from a group, a particular person, and has to as a identification type. This is targeting To identify by way of targeting means to select a particular individual from a group as an object of attention or treatment in a single moment of time. is the of It not and to identification, not on a such as an or and not to an individual a targeting in and the single moment of classification identification, targeting not to identify an individual as a of one or and not a of the and of the that an individual in the of targeting is in on a particular individual is from This in to that individual to treatment or by means of a that not need to or based on the by a in and of an individual that that individual from of by means of a is identification by a is a to a by its as a for in a of of a particular which to identification, or of the on a which a such of while for when not for and one from for the of in a is the of a whether or in to one its from a single moment of rather than or is that for of the of when facial data is to facial of known facial data not to to facial and not to to facial data is to one from in a single moment of which is not or This in the of or in to and data from facial and individual on the of a on the of a identification by is in all and data for and This has been by new based on a the is not facial or a but that that a is in and that that and its from The with the based on a single is addition to distinguishing an also or a is one of such is a to the of a a and and and data a that to when is not the of The data in the to a of a person, to a person a to This identification in the of or and of that To on the of a one is or in to a of or within a an such as facial and or the of the a as a for such that the of is to contextual such as the based on with classification identification in the that the is based on or or that to or The is with classification which is a of in one or by or in of the of the or of the the on the The the the is and this which is based on of a of an individual relevant to in what with classification and targeting is not with a person as a of one or but individual is by an of a of and group and not the and but The is relatively on the of is to a a of a of classification practices a the in which and and to a person being or to the While based on and known and relatively such as or and is and in the of the the and not but a the but and and identification by in the of or identification is and Yet, as a of an of a of The such is a and based on as a of a to in for a data with the of on a of to than the the of data is to and and the focus of the and also lies on and identification to a individual with or treatment on by and and therefore the in the types of identification from the of that the identification types also based on a the and identification types a that or a particular person time. and identification, by a a or a of a person for or or a person based on that in the or identification also has this to the of one a which the in the and targeting identification clearly not such a an identified person is or based on the or in with is an integrated typology of identification as in typology of identification typology of identification The GDPR not define The relevant of the GDPR is the Article of data is relating to an identified or identifiable natural person an identifiable natural person is one identified, or in particular by to an such as a an identification an or to one or to the or of that natural The refers to an and identifiable natural that identifiable natural person is one such as that identification, but is as to whether or not an individual is by a or on when a natural person identifiable and the of means to to for all of the to Yet, while in the clearly refers to the possibility of identification, ie of being identified, of what means is is by the Article 29 Working The Article 29 Working an EU on the of data protection under the Data Protection (the a on the concept of data The current of the is not the one the concept of data in the and not the the Article 29 Working Party and is by a new Data Protection to this of the Article 29 Working Party a of Article 29 Working Party is not the an that the its also under the since the concept of data has not While in the to issue its on the concept of data and a on what identification has not and its for has to data protection concepts such as this the Article 29 Working Party remains and as such an of identification which is in with its a natural person as within a group of or is from all of the and natural person is the person has not been identified is to the of the the also as for from the to a particular or to in on a and The that identification is the The of which a and with the particular a of the of this person, or a of the person which a a The not light on the that that or not all of the of that and in to an While a a and a to in that particular to an individual to a with a and a or to that individual a and a is to a an individual and or or or since of of and individual of by the or a of the a of and an individual that of an to the remains Therefore a and way to define an as a of or in with a person in a attention is what the as and identification, and when an individual is identified and The that a person identified or identifiable or or in the of data identifiable natural person is one identified, or to an identified as as identifiable natural person, and not to the This from the of the of data in the the to the also in which a person person identified by or the the that person identified by or by a a a a or by a of which to by the group to which of The that identification by as identification, and identification by single such as a a a or a as the identification by a of that the group to which a person as a of While the not with this its to this While the is is not for the of the is the of identified or rather than and The is that is not to the that from the this this is to an interpretation of the rather than its identified or identifiable the that the the in the of a to the Yet, not in all to identify an to one person from such as to in or such as and a is the the to identify an individual the of or in the and not the to or the the of data in the which the GDPR not the and the which identify both and on the a person identified not by but by to identification refers to the identification of This is what the of data in on the of identification refers individual identified by to one or to the or of that natural person is when the of is and to that person from a group, while when is that person is whether or not an individual is identified by the on the to all need to while whether or not an individual is of whether the individual to the is identified or not on the of the a to identify a particular person within a of a when is a but identify a in a the such as and of for what the an such as that a person is a and to identify a person in a particular to one person from the a light This in the meaning of identification as in person is ie from the group, by or which is and is person is when such a is not but is to person is by a of which is ie is to person is when such of is and is to to that of or identified or of or identified or To a to the by the the the whether or is the and in this that the to one from an of what a within its legal all of the of The to The that all of the to is that to the natural While the of the not to from a or a While this article is a of group such as current and of to its as a one of to single one person in a group, but to this this the While not in by the Working the issue of of identification is for the meaning of identification under the GDPR. the chance that person the identifying is or or relatively an identifying not in the but is in a group or a The the Working Party to is of the This from the the Working Party on the of for To to which certain to identification is on the of the particular a by a light is identified by an not a in a ie a group of a relevant the in the of is of data in to identify not and the is to individual in and for a possibility of the with the and the a and identified the of the and is and by one to an individual identified in the of the GDPR both by an a of and by an that is in a particular within a or in a for or to with that to one individual in a the Working Party that the is to regarded as data but relating to an rather than identified natural the of is to identify in a or the with that the to the data The to identification a of the GDPR as the integrated typology of identification with and targeting identification within the meaning of identification as distinguishing from the group, as to in on someone as an individual from the individual remains or the in is not in and is to of a or in of targeting and To someone by the of data of an identified person, in the of identification the individual is by on a or in the of identification the or to one in a from for the of a The to of the is and identifiability is not a to an individual is of data relating to an identified natural person in the of targeting identification when the is in This is from what the or distinguishing a person in a group the that time.

The when not in to an identifiable person its to ie to on a or in to in targeting identification and of data relating to identified when the ie as This to the with of or to the in While the is to the and to a on the to the to the in the natural the to the data to individual in a to to The of classification as identification under the GDPR is on its is not identification in the of the when a to identification is has in the of facial or of in a system in to identify an It to the or this not data the the is not with an or the for as as not an individual from a group but an individual to a group, not identification, is to an individual identified in ie or This is to the discussion the of group as a group data when to an identified or identifiable and the that the possibility to identify on a classification of a person identification in its and the to of identification under certain which the classification a of a classification of an individual as a of with the someone as a not to one person from the of a but in a the Working Party of a person a an not but to one particular person the the the CJEU been in the concept of The of on the meaning of data in its data protection and on a of since to the has not been as on the meaning of the of this concept, The that the of the when of the data protection law and the data by the The of the relevant that a particular of data is personal, or the of a person but also or or and and paid by certain and the of or and of natural been to the meaning of identification in but is on whether or not the data is to identified or and whether or not identification in the of data protection law or in with a relatively the a of what particular of the concept The law on the meaning of identification is and the that the of data to which interpreted to both that the the and the the and that the the the identification the the on the meaning of The as the of the to the to identifiability in EU data protection in of the Data Protection and to by the a interpretation of the criterion of identifiability and a meaning of the concept of has been a in data protection law. Yet, the role of in the meaning of identification and what means to an identified natural person has has that the CJEU in the of identification as distinguishing or being from a group, by the Working to the decision a possibility of identification by not the to The since the not identified by while the of is to one from the the of as by in the of the its on what means to one that is that a not relating to an natural since such an not the of the natural person the from which a or that of person that this the with the referring and the person to which is not an natural not or the of the natural person the to the or the of the the natural This reading of the meaning of identification and to the identification, ie by means of a person to This of identification therefore of the of the GDPR practices which been to data and thus under the but which not to a of an individual by a or This but is not to when the data not and a person is the facial when the facial not with the individual targeted a person by means than and While in in Breyer, to that the data to a person is when the for the identification is not in the of a but is to for the identification not the in legal as the of identifiability not data to known by a chance of that or the of the the concept of identifiability is a identification and its meaning is from the meaning of the means identification the the