Recital 23*

Go to related Article 4

Commission proposal

(23) The principles of protection should apply to any information concerning an identified or identifiable person. To determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the individual. The principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable.

EDRi’s Proposed amendment

(23) The principles of protection should apply to any information concerning an identified or identifiable person. To determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the individual. The principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable taking full account of the technological “state of the art” and technological trends.

Justification
Removing “reasonably” widens the scope of the measures to be considered when assessing whether an individual is identifiable. This is also important, since the “state of the art” in de-anonymisation is continuously developing. There is a significant risk for protection of personal data if this fact is not taken into account.

Advertisements
  • eu logo The launch and upkeep (until December 31, 2013) of this website received financial support from the EU's Fundamental Rights and Citizenship Programme.
%d bloggers like this: