Double standards: On the Digital Omnibus re GDPR, the EDPB & EDPS claim the Commission shouldn’t have the power to adopt implementing acts to “specify means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities”.
Yet under the Digital Markets Act, no problem at all.
The situations are “firmly different”, said the EDPB & EDPS, because under the DMA the Commission is empowered “as enforcer of the DMA to specify the measures that the gatekeeper concerned is to implement in order to effectively comply with the obligations laid down in the DMA”, while under the Digital Omnibus re GDPR, the proposed Article 41a GDPR would allow the Commission “to set out general means and criteria applicable to all controllers for assessing whether data resulting from pseudonymisation no longer constitutes personal data”.
This is a bit of a fallacy.
Where a term is not made specific in law, it is not meant to be an autonomous concept. “Anonymisation” is not defined in the DMA or in the GDPR, so it should be interpreted the same way. This means that “anonymisation of personal data” under the DMA (= an obligation as far as search query data is concerned) is not supposed to be any different from the idea of anonymisation of personal data (to which Recital 26 GDPR refers).
As a result, Commission requirements for anonymisation will be at least indirectly relevant for *all* controllers, as they tell us what is deemed “anonymous”. Pretending that the search context makes them irrelevant is unhelpful to everyone, from businesses who need rules to be clear and workable, to data subjects who need enforceable rules. Different standards don’t make rules enforceable, clear or workable.
In this context, the EDPB/EDPS fear that an implementing act pursuant to the Digital Omnibus “could de facto affect the material scope of EU data protection law, effectively redefining the scope of when and for whom information is considered personal data” is not a great excuse, as this has *already materialised* – based on a power foreseen by law since over 3 years.
In practice, this is a turf war born out of bad law. We need *one* authority to be able to tell us what is or is not / no longer personal data – and for that authority’s positions to be clearly challengeable. Accountability and consistency, to allow for greater legal certainty and foreseeability.
Perhaps then what we really need out of the Digital Omnibus is a change to Article 70 of the GDPR? Or a de-coupling of the power to dictate interpretation and the power of enforcement?
More on the Commission’s approach to anonymisation of personal data under Art. 6(11) DMA and some of the issues it raises in data protection terms: https://lnkd.in/euu2b9es
Did this analysis get you thinking? Reach out!
DataLaws.net is entirely open-access, and instead of getting your data in exchange for this content, how about another trade? If this commentary saved you research time or sparked an idea, feel free to invite me over for tea, chai or a hot chocolate next time you are around Brussels or Antwerp - or invite me over to your offices for a chat!
Get in touch ↗ Let's connect on LinkedIn ↗