Amendment 226· Digital Omnibus proposal Recital 27a (new)

(27a)The case-law of the Court of Justice (Case C-413/23 P, EDPS v SRB) confirms that the personal character of data is not an absolute feature and that pseudonymised data may, depending on the circumstances of the case, not be identifiable for a given recipient. However, that assessment is, by the Court’s own method, a factual analysis to be carried out in each individual case, taking into account the means reasonably likely to be used and the technical, organisational and legal measures in place. Such a contextual and evolving assessment cannot be transposed into a general and abstract rule written into the definition of personal data in Article 4 without distorting that method and weakening the level of protection. The definition of personal data therefore remains unchanged. The relative and contextual character of identifiability is reflected in the graded regime of Article 4: what is decisive is whether the data is re-identifiable. Pseudonymous data is potentially re-identifiable; anonymised data is not re-identifiable; pseudonymised data is data that has undergone a state-of-the-art privacy-preserving service or technique. Pseudonymised data remain personal data for the controller holding the additional information and cannot as such be regarded as anonymised.