Recital 27b

In light of the interpretation provided in the case-law of the Court of Justice of the European Union, it is important to provide further clarity on when a natural person should be considered to be identifiable following the application of pseudonymisation to personal data and the transmission to a recipient, as well as when such recipient further discloses, transmits or otherwise makes such data available to a third party. In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly, such as singling out or online identifiers. The identifiability of a natural person should be assessed considering the actual technical and organisational measures, and based on objective factors and applicable prohibitions by law. These factors may include the state of the art of the techniques used to pseudonymise the data, the properties of the data itself, the cost and time needed for the third party to obtain such additional information and the legal obligations of the third party.

Data which are in themselves impersonal may become ‘personal’ in nature where they are put at the disposal of other persons who have means reasonably likely to enable the data subject to be identified. This applies to both the party that transmits this data and the third party that subsequently processes this data. Whether means are reasonably likely to be used will depend on the relevant entity’s perspective, which depends on the specific nature and context of the processing, such as who has access to or control over the data, whether the data is being transmitted from one party to another, the relationship between those parties, and whether a receiver of the data might process it on behalf of another party.