Recital 27b

In light of the interpretation provided in the case law of the Court of Justice of the European Union, it is important to provide further clarity on when a natural person should be considered to be identifiable following the application of pseudonymisation to personal data and the transmission to a third party. as well as when such a third party further discloses, transmits or otherwise makes such data available to another third party. Pseudonymisation may, depending on the circumstances of the case, effectively prevent persons other than the controller from identifying the data subject in such a way that, for them, the data subject is not or is no longer identifiable.

In order to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used to identify the natural person directly or indirectly, such as singling out or online identifiers. A third party who processes the pseudonymised data should not be considered to have access to such means, if the likelihood of identification appears in reality to be insignificant, because it would be impossible to do or would involve disproportionate effort in terms of time, cost and labour, or because of a legal prohibition. The identifiability of a natural person should be assessed considering the actual technical and organisational measures, and based on objective factors, including legal obligations and prohibitions by law applicable to the third party. These factors may also include the state of the art of the techniques used to pseudonymise the data, the properties of the data itself, and the cost and time needed for the third party to obtain such additional information. It is important to recall that, for a controller applying pseudonymisation or a processor processing on behalf of the controller, the data subject remains identifiable and therefore Regulation (EU) 2016/670 applies. Data may become ‘personal’ where they are put at the disposal of other persons who have means reasonably likely to enable the data subject to be identified. This applies to both the party that transmits this data and the third party that subsequently processes this data. Whether means are reasonably likely to be used will depend on the relevant circumstances, which include the specific nature and context of the processing such as who has access to or control over the data, whether the data is being transmitted from one party to another, the relationship between those parties, and whether a receiver of the data might process it on behalf of another party.