EDPB pseudonymisation guidance on residual reidentification<\/a> risk underlines, datasets travel through companies, link with other sources, and recombine over time into realistically identifiable profiles supporting precise targeting\/profiling, yet middle players may treat them as \u2018non-personal\u2019 and operate without full transparency duties, data subject rights, or core principles like purpose limitation\/data minimisation, despite downstream actors\/data matches making relinking realistic.<\/p>\n\n\n\nTake a scenario where Gym A holds class attendance records with full member identifiers (names, IDs). It pseudonymises the data by replacing names with codes such as M\u20111, keeps the reidentification key, and sends the pseudonymised dataset to Analytics Agency B for usage pattern modelling, with B acting not as a mere processor but as an independent controller that has no contractual right to obtain the key and is subject to strict technical and contractual prohibitions on lifting the pseudonymisation. Ad Tech Company C separately holds rich app data (browsing, location, profiles) on many of the same gym members.\u200b<\/p>\n\n\n\n
Under the current GDPR understanding, the legal position can be framed as follows. For Gym A, the data are clearly personal data: A holds the key and therefore has means reasonably likely to be used to reidentify, so pseudonymisation functions as a security measure rather than anonymisation. For Agency B, the assessment focuses on whether B, as the actor in question, has reasonably likely means to obtain additional information that would enable identification; for example, lawful access routes to the key, realistic access to auxiliary datasets, or other practical mechanisms to relink the codes to individuals in the specific context, as illustrated in Breyer and in the contextual analysis endorsed in SRB and IAB Europe. For Company C, if C receives the pseudonymised dataset and can match it with its own profiles (for instance by correlating attendance times and locations with app tracking data), the combined dataset is personal data for C because C then has realistic means to single out and identify the gym members. The practical effect is that, where such realistic identification routes exist, pseudonymised data tend to remain personal data across the chain, so A, B and C all face the duties mentioned in GDPR in their respective roles, limiting protection gaps in the current framework.\u200b<\/p>\n\n\n\n
Under the Digital Omnibus model, Gym A’s position remains unchanged: A retains the key, so the dataset is personal data for A. For Agency B, Article 4(1) read with Recital (27) states pseudonymised information is not automatically personal data \u2018in all cases and for every person or entity\u2019, and is not personal data for a given entity lacking means reasonably likely to be used to identify the person; such an entity is then, in principle, outside the GDPR for that dataset. If B (independent controller) has no contractual key right, no technical route to lift measures, and no auxiliary datasets for cross-checking, B can claim the dataset non-personal for B; even though Recital (27) accepts it becomes personal for Company C (with realistic identification means, expressly including cross-checking other data). The policy concern: Omnibus increases intermediaries like B credibly claiming out of scope \u2018in principle\u2019 where their processing materially contributes to later reidentification.<\/p>\n\n\n\n
On that basis, the troubling gap is best illustrated where Agency B really does lack means reasonably likely to identify gym members under the Omnibus test, for example because B has no contractual entitlement to request the key from Gym A, faces strict technical separation and audited prohibitions on reidentification, and holds no auxiliary datasets that would make cross\u2011matching feasible. Even in that configuration, B\u2019s modelling and onward transfer of the pseudonymised dataset can significantly enable Company C\u2019s later reidentification and targeting once C combines the file with its own rich profile data, which Recital (27) recognises as making the information personal data for C, while B may nonetheless remain out of scope in principle for that dataset, so that an important intermediary phase of processing that is a necessary step in enabling later identification and targeting can sit outside GDPR duties and remain effectively unregulated.<\/p>\n\n\n\n
By artificially breaking the chain, it lets key intermediaries like Agency B slip right out from under the oversight of the GDPR, even when their analysis and passing on of pseudonymised gym data sets up Company C to reidentify and target people later. If B claims no solo reidentification power, it dodges transparency duties, data subject rights like access, erasure or objection, and core rules on purpose limitation. Gym A can’t really rein B in through contract alone; Gym A might stipulate \u2018no reidentification\u2019 or \u2018delete after analysis\u2019, but B could still quietly enrich or overshare the data without detection, forcing costly audits with remedies limited to damages, not the direct rights, fines or other rights that the GDPR guarantees. C ends up with a ready-to-use dataset, and individuals lose grip on the whole chain.<\/p>\n\n\n\n
Final Implications<\/strong><\/h4>\n\n\n\nThe SRB judgment and Digital Omnibus proposal fundamentally recast GDPR identifiability. They shift it from a contextual, ecosystem-wide safeguard, where pseudonymised data stays protected across linked actors, to a narrow actor-specific test. This makes pseudonymisation a potential escape from the scope of GDPR for recipients without realistic reidentification means, even when downstream players can easily relink and target individuals.<\/p>\n\n\n\n
Unchecked, this allows pseudonymized datasets to pass through unregulated intermediaries like analytics firms. Such actors dodge transparency obligations, data subject rights (access, erasure, objection), and principles like purpose limitation and data minimization. Upstream controllers have weak contractual leverage, while the end result erodes holistic protections, individual control, and the GDPR’s core promise of effective oversight in complex data chains.
<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Abirami Vishwanathan is a Final Year BBA LLB (Hons.) student at School of Law, Sastra Deemed University. The European Commission proposed the […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1311","post","type-post","status-publish","format-standard","hentry","category-blog-series","col-md-6 col-sm-6"],"_links":{"self":[{"href":"https:\/\/clt.nliu.ac.in\/index.php?rest_route=\/wp\/v2\/posts\/1311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/clt.nliu.ac.in\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/clt.nliu.ac.in\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/clt.nliu.ac.in\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/clt.nliu.ac.in\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1311"}],"version-history":[{"count":3,"href":"https:\/\/clt.nliu.ac.in\/index.php?rest_route=\/wp\/v2\/posts\/1311\/revisions"}],"predecessor-version":[{"id":1315,"href":"https:\/\/clt.nliu.ac.in\/index.php?rest_route=\/wp\/v2\/posts\/1311\/revisions\/1315"}],"wp:attachment":[{"href":"https:\/\/clt.nliu.ac.in\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/clt.nliu.ac.in\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/clt.nliu.ac.in\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}