Article 32pa

Where the data or documents made available for re-use under this Chapter contain personal data, the public sector body shall, prior to allowing re-use, apply state-of-the-art privacy-preserving and privacy-enhancing techniques within the meaning of Article 4 of Regulation (EU) 2016/679, including pseudonymisation, so as to reduce the likelihood of attribution of the data to a specific natural person while preserving their utility for the purpose of re-use.

The measures referred to in paragraph 1 shall be designed to protect personal data and data relating to identifiable natural persons against re-identification, against personal data breaches, and against unlawful use and trade, taking into account the means reasonably likely to be used. The residual risk of re-identification, including by algorithmic means, shall be assessed and documented.

Where the re-use of personal data requires the consent of the data subject, the public sector body or the competent body shall facilitate the giving, refusal and withdrawal of that consent, including by automated and machine-readable means and, where appropriate, through a consent and agency-enhancing service provider within the meaning of Article 2, point (38f). Consent obtained for re-use shall be specific to the purposes of re-use and shall not be presumed from consent given for the initial purpose for which the data were collected.

This Article is without prejudice to Regulation (EU) 2016/679, which shall prevail in the event of conflict, and to the conditions for the re-use of certain categories of protected data laid down in Section 3.