Among the proposals under discussion is a streamlining of the rules regarding pseudonymization and data processing for model training, aligning with the EDPB’s most recent opinion on AI models.
In this context, the new guidelines appear intended to prevent the goal of simplification from being interpreted as a loosening of the concept of anonymization established by the Court of Justice.
Indeed, the document presents two approaches: a contextual one—which adheres more closely to the regulatory standard but is burdensome to apply on a case-by-case basis—and a simplified one, which is more cautious and designed as a prudential tool for the data controller performing the anonymization (rather than serving as an alternative standard for third parties wishing to challenge the controller’s assessments).
This distinction can also serve as a practical reference point for the Omnibus negotiations, offering lawmakers a proven framework for balancing legal certainty with substantive protection. The EDPB further clarifies that anonymization remains, for all intents and purposes, a form of personal data processing; it requires a legal basis and—where applicable—a specific exception when special categories of personal data are involved.
The guidelines also specify that when anonymization forms part of the processing activity, the legal basis (and any exception for special categories of data) is presumed to be the same as that of the preceding processing operation. The message here is clear: simplifying downstream obligations (those related to the reuse of anonymized data) cannot mean eliminating upstream safeguards regarding the anonymization process itself.
The guidelines are open for public consultation, offering AI sector stakeholders an opportunity to share their expertise on a framework destined to become the European standard for anonymization—precisely as the Digital Omnibus reshapes the regulatory landscape.
Marco Bassini, Professor of AI and Fundamental Rights, Tilburg University; Oreste Pollicino, Professor of Constitutional Law and AI Regulation, Bocconi University.
AI Governance: AI models at the crossroads of new European GDPR rules
Authors: Marco Bassini & Oreste Pollicino
Translation performed by an AI assistant.
Leggi anche:
