Amendment 257· GDPR Article 41a

Article 41a (1) The Commission may adopt implementing acts to specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. (2) For the purpose of paragraph 1 the Commission shall: (a) assess the state of the art of available techniques; (b) develop criteria and or categories for controllers and recipients to assess the risk of re-identification in relation to typical recipients of data. (3) The implementation of the means and criteria outlined in an implementing act may be used as an element to demonstrate that data cannot lead to reidentification of the data subjects. (4) The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. (5) The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).

‘Article 25a - Application of pseudonymisation and identification of a natural person (1) Controllers and processors may apply pseudonymisation in order to reduce the risks to the data subjects concerned and to comply with their obligations under this Regulation, in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. The application of pseudonymisation shall be subject to appropriate technical and organisational measures, including security measures, to prevent other persons from identifying the data subject. (2) Pseudonymised data shall not be considered personal data for third party if that third party is unable to identify the natural person to whom the data relates. (3) Where a third party discloses, transmits or otherwise makes data referred to in paragraph 2 available to another third party and, in light of all relevant circumstances, that other third party possesses or can obtain means reasonably likely to enable the data subject to be identified, both the transmission of the data to that other third party and the subsequent processing of the data by that other third party is processing of personal data. (4) Where a processor processes personal data on behalf of a controller, that data shall be considered personal data for the processor, and the processor continues to be subject to the obligations applicable under this Regulation. (5) To determine whether a natural person is identifiable, including through personal data having undergone pseudonymisation, account shall be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly. (6) The Board shall issue an opinion, in accordance with Article 64(2) of this Regulation, addressing the application of pseudonymisation and anonymisation, including related technical and organisational measures. (7) The Chair of the Board shall request the opinion referred to in paragraph 4 no later than 6 months after the entry into force of this Regulation. The opinion shall be reviewed and updated where necessary.