Personal data: relative concepts in the Digital Omnibus

Digital Omnibus & GDPR: I like some things & dislike others about the proposal, but want to push back against claims that the “personal data” definition change will weaken protection. Of course some data protection supervisory authorities will say this (non-personal data generally falls outside of their remit), but is there truly weakening of protection if the change corresponds to today’s state of case law?

Let’s break down that addition to Art. 4(1) GDPR:
[+ line breaks for readability]

***
Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person.

Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity.

Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.
***

The first 2 sentences? That’s the relative nature of personal data, which Recital 26 GDPR hints at (and Directive 95/46/EC before that), which the Breyer judgment suggested and which SRB finally made abundantly clear. It’s difficult to see how that changes the current state of data protection law.

Ah, but Breyer / IAB Europe / … talk about information not in the hands of the controller!” Sure, but that’s irrelevant if *my* obtaining of the information through the third party isn’t lawful or realistic (see Breyer para 46; SRB para 82). Means are only “reasonably likely to be used” if foreseeable, lawful and proportionate – if identifying information in theory exists but I can’t get it or I can’t get the third party (e.g. in case of joint controllership) to identify the natural person for me, that’s irrelevant.

The 3rd one? It might seem new at first glance, but it’s actually in line with the SRB, Scania & OLAF judgments. Scania and SRB make it very clear that only *actual* recipients have to be taken into account, not *potential* ones (para. 49 in Scania, para. 84 in SRB). Even OLAF (OC v Commission) was concerned with the *actual* recipients, in particular investigative journalists (para. 57-58).
So information can become personal data if *actual* (not merely *potential*) recipients have those means at their disposal.

I’m not so certain there is an actual change to the state of data protection law today. (“Why do we need a change then?” Good question, but such codification sometimes helps to make case law more accessible, which is a good thing.)

More on the topic:
– A deep dive on SRB: https://lnkd.in/e2eNmGUP
– A debate on the Digital Omnibus: https://lnkd.in/eXVSEAus
– Some positive thoughts on the GDPR aspects of the Digital Omnibus: https://lnkd.in/eXRWUfvA
– Some less positive thoughts on the Digital Omnibus & ePrivacy: https://lnkd.in/ezXT6ERi