Article 41b

The European Data Protection Board established by Article 68 of Regulation (EU) 2016/679 shall issue guidelines on the application of Article 4, point (1), to data resulting from pseudonymisation, in particular where such data are disclosed to a recipient and may be considered not to constitute personal data for that recipient.

Those guidelines shall address, in particular:

1. (a)

   the criteria for assessing whether a recipient is realistically able to identify the data subject, either from the data alone or by combining the data with other information reasonably available to it;

2. (b)

   the information, documentation and commitments that may be provided by the recipient concerning its means, access rights, available datasets, technical capabilities, organisational measures, and legal or contractual restrictions;

3. (c)

   the proportionate due diligence to be carried out by the controller disclosing the data before relying on the conclusion that the recipient is not realistically able to identify the data subject;

4. (d)

   the conditions under which recipients may be grouped by category where their relevant circumstances are materially equivalent;

5. (e)

   the evidence to be retained by the controller and, where relevant, by the recipient, in order to demonstrate the basis for the assessment to the competent supervisory authority upon request;

6. (f)

   the circumstances in which a material change in the recipient's means, access rights, available datasets, technical capabilities, organisational measures, or legal or contractual restrictions requires the assessment to be reviewed; and (g) the effect of such assessment on the qualification of the data for the controller, the recipient and any other person that is realistically able to identify the data subject.

The guidelines referred to in paragraph 1 shall take into account the state of the art; relevant case law; supervisory practice; risks of identification through attribution, singling out, linkage, or inference; and the use of technical and organisational measures reducing the risk of identification.

Those guidelines shall not alter the definition of personal data under Article 4, point (1), create a presumption that data resulting from pseudonymisation are not personal data, or reduce the level of protection of personal data under this Regulation.

Controllers and processors may apply pseudonymisation, and anonymisation, or other Privacy Enhancing Technologies referred to in Article 25a to personal data in order to reduce the risks to the data subjects concerned and to help meet their obligations under this Regulation, in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. To determine whether a natural person is identifiable, including through personal data having undergone pseudonymisation, account shall be taken of all the means reasonably likely to be used, such as singling out or online identifiers, either by the controller or by another person to identify the natural person directly or indirectly.

Paragraph 1 is without prejudice to other provisions and obligations applicable to the controller and processor, including under Chapter IV and V of this Regulation.

The Board shall issue an opinion, in accordance with Article 64(2) of this Regulation, addressing the application of pseudonymisation and anonymisation to personal data, including related technical and organisational measures, and specifying means and criteria to determine whether and when such may effectively prevent persons other than the controller from identifying a data subject, in such a way that, for them, the data subject is not or is no longer identifiable, and where information relating to the data subject no longer constitutes personal data for that person other than the controller.

The Chair of the Board shall request the opinion referred to in paragraph 3 no later than 6 months after the entry into force of this Regulation. The opinion shall be reviewed and updated where necessary.

The Commission may adopt implementing acts specifying technical and organisational criteria, methodologies and standards where necessary to ensure uniform conditions for the application of paragraphs 1 and 3, or where further clarity is required following the issuance of the opinion referred to in paragraph 3, The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).