Perspectives on EDPB & EDPS Joint Opinion on Digital Omnibus

Some thoughts (+ & -) on the EDPB & EDPS’s joint opinion on the GDPR & ePrivacy Digital Omnibus, part 1:
+ The overall tone seems constructive

– On the definition of personal data (PD), I don’t think quoting the Scania/SRB situation of information being “indirectly” PD for a disclosing party (§16) helps the EDPB/EDPS’s argument that the new definition would create legal uncertainty. That part of Scania is precisely a huge source of uncertainty, so the proposed definition change helps *improve* legal certainty, not reduce it.

– They claim that this change “may induce controllers to seek loopholes” re data protection rules (§17) and that some controllers might then implement “nominal measures to separate their processing activities from the means reasonably likely to be used to identify the data subjects […] while still allowing for abuse of data subjects’ [PD]”, such as by “artificially outsourcing certain activities or capabilities to external companies, using a structure which deliberately avoids the limitations and protections that come from meaningful anonymisation techniques.
The examples given suggest processorship – which the Danish DPA said falls under the authority of controllers, such that there *are* means reasonably likely to be used for identification.
So anyone seriously invoking “non-PD” *won’t* be in those situations but will be seeking to properly pseudonymise data.
Isn’t higher protection and less processing of PD precisely something the DPAs should applaud?

– They continue to quote “singling out” as an important consideration (par. 17), but that is just one element in the process of identification and not the sole criterion (or a decisive one), as I have written extensively about.

– On scientific research, the EDPB/EDPS clearly doesn’t want proprietary commercial research in scope, despite this being fundamental to a number of sectors. It’s awkward to have a strict stance on pseudonymisation *and* want the “research” exception to involve publication of results (§29), as that’s just denying the needs of a whole realm of research for whom such transparency will not be viable (e.g. not everything is patentable).

+ They recognise the importance of clarifying “under what conditions no legal basis separate from the legal basis for collection of the [PD] is required for further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes” (§31). Unfortunately, they make no proposal to that end.

– On biometric data, they welcome the biometric exception for identity confirmation, but they immediately include conditions (§36) similar to their “facial recognition in airports” Opinion 11/2024 – which I have criticised previously for being disproportionate.

– On AI, they welcome changes while suggesting much needs clarifying, referring to their AI Opinion 28/2024 – yet that Opinion contains much that is debatable.

Part 2 to follow + useful links in comments.