Recital 27a

Regulation (EU) 2016/679 already has elements of a risk-based approach. However, especially small and medium enterprises cannot benefit from a risk-based approach if the necessary legal certainty is not provided through clear thresholds. To increase the legal certainty for more limited processing the objective categories for small, medium and large processers is introduced. Small controllers are all controllers that have or will process the data of less than [100.000] data subjects in the pending or preceding financial year, including short-term transactional processing. As a default the current rules in the Regulation are maintained and controllers are deemed a medium controller. A controller may only benefit from the privileges for small controllers if there is positive knowledge about fulfilling the criteria. Controllers like hospitals or Unions that by their very nature process large numbers of sensitive data under Article 9 or 10 of Regulation (EU) 2016/679 shall not be deemed a small controller. While small controllers must not comply with many administrative requirements of the Regulation, the rights of data subjects, which are largely based on Article 8(2) of the Charter are not altered. Given the existing burden of proof of controllers, the lack of formal documentation shall not limit the effective enforcement of data subjects’ rights. In the rare case of a complaint or procedure against a small controller, they may proof compliance with any formal or informal evidence according to national procedural law.

Trustworthy processing of data and legal clarity is necessary for economic growth and supporting innovation with socially beneficial outcomes. In order to achieve this, some clarifications are necessary particularly to enable wide use of anonymisation. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. However, personal data that cannot be directly or indirectly attributed to a natural person is not within the scope of Regulation (EU) 2016/679. Controllers should be allowed to process personal data for the sole purpose of anonymizing personal data. Such processing should typically be understood as a legitimate interest for a controller. At the same time, the protection of data subjects’ rights typically benefits from anonymization. Consequently, the balancing test should favour the processing of personal data for anonymization. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and foreseeable technological developments.

The case-law of the Court of Justice (Case C-413/23 P, EDPS v SRB) confirms that the personal character of data is not an absolute feature and that pseudonymised data may, depending on the circumstances of the case, not be identifiable for a given recipient. However, that assessment is, by the Court's own method, a factual analysis to be carried out in each individual case, taking into account the means reasonably likely to be used and the technical, organisational and legal measures in place. Such a contextual and evolving assessment cannot be transposed into a general and abstract rule written into the definition of personal data in Article 4 without distorting that method and weakening the level of protection. The definition of personal data therefore remains unchanged. The relative and contextual character of identifiability is reflected in the graded regime of Article 4: what is decisive is whether the data is re-identifiable. Pseudonymous data is potentially re-identifiable; anonymised data is not re-identifiable; pseudonymised data is data that has undergone a state-of-the-art privacy-preserving service or technique. Pseudonymised data remain personal data for the controller holding the additional information and cannot as such be regarded as anonymised.

Pseudonymised data should be presumed not to constitute personal data for an entity that has no lawful means of access to the additional information necessary for identification and no means reasonably likely to be used to identify the natural person, in line with the case-law of the Court of Justice of the European Union. That relative approach provides legal certainty for the sharing of data for research, statistics and the development of artificial intelligence, without lowering the level of protection where identification remains reasonably likely.