On 12 October, SAMMAN Law & Corporate Affairs and Team Blaeu hosted a policy lunch in Brussels, bringing together policymakers, regulators, privacy experts and companies from a range of sectors. The event marked the presentation of the joint policy report From Pseudonymised to Anonymous Data, authored by Dr. Rob van Eijk (Team Blaeu) and Benjamin de Vanssay (SAMMAN Law & Corporate Affairs). Drawing on five concrete use cases provided by European businesses, the report examines where pseudonymisation ends and anonymisation begins.
The discussion took place as the Digital Omnibus reopens the debate on the scope of the General Data Protection Regulation (GDPR). Participants agreed that this debate should not fall into a false dichotomy between protecting fundamental rights and simplifying regulation. The GDPR already provides a robust framework for personal data protection. European businesses already use advanced pseudonymisation techniques that create significant economic value while preserving individuals’ privacy. What industry needs is not less protection but greater legal certainty.
Participants highlighted that the Court of Justice of the European Union (CJEU) has reaffirmed the relative, recipient-specific nature of personal data in its ruling involving the Single Resolution Board (SRB). Together with the ongoing work of the European Data Protection Board (EDPB) on anonymisation and pseudonymisation, this case law could lay the foundations for a clearer, more objective framework that eases both compliance and enforcement.
Three avenues emerged for delivering that legal certainty. The first is codifying CJEU case law and Recital 26 of the GDPR. Several participants supported codifying the SRB ruling to curb diverging interpretations by national authorities and courts, while others preferred clear safeguards that leave the definition of personal data untouched. The second is guidance and codes of conduct. Expectations are high for the EDPB’s draft guidelines on anonymisation and its forthcoming guidelines on pseudonymisation, which could be complemented by a code of conduct facilitated by the European Commission. The third is standardisation and certification. Experts proposed a new assessment methodology, built on EDPB guidance and case law, as a stepping stone toward certification and standards. A dedicated certification scheme would distinguish pseudonymised data, which remains subject to the GDPR, from anonymised data, which falls outside its scope, with particular attention to small and medium-sized enterprises (SMEs).
The Digital Omnibus is a key opportunity to settle the long-standing debate on the boundaries of the GDPR and unlock the untapped potential of Europe’s data economy. SAMMAN thanks all participants and will keep engaging with stakeholders to support constructive negotiations on this file.
