EDPB Anonymisation Guidelines: What They Mean for AI Systems & GDPR

The EDPB has issued its new Guidelines on Anonymisation, and they could have major implications for AI systems, AI training data and GDPR compliance.

In this episode of the Legal Break, Giulio Coraggio discusses the new EDPB Guidelines with journalist Antonio Ravenna and explains what they mean in practice for organisations developing or deploying AI.

Among the key issues discussed:

• When can data really be considered anonymous under the GDPR?
• Why anonymisation is relative and context-dependent
• The EDPB's three criteria: No Record Isolation, No Linkage and No Inference
• Why AI models and synthetic data create new re-identification risks
• How AI can make inference and re-identification easier
• Why simply removing names and identifiers may not be enough
• What the Guidelines mean for AI developers and businesses using personal data
• Why organisations should periodically reassess whether data remains anonymous
• The relationship between the EDPB's anonymisation guidance and its approach to AI and web scraping

The EDPB Guidelines 02/2026 were adopted in July 2026 and are currently open for public consultation until 30 October 2026.

The key message: anonymisation is no longer something organisations can assume; it needs to be demonstrated, tested and reassessed.

📌 Read the full analysis:
https://www.gamingtechlaw.com/2026/07/edpb-anonymisation-guidelines-ai/

Send us Fan Mail

Episode Transcript

SPEAKER_01 (00:00):
Hello everyone, I'm Giulio Coraggio, the location
head of the Italian IntellectualProperty and Technology
Department at the Law Firm DLAParter.

SPEAKER_00 (00:07):
And I'm Antonio Ravenna, a journalist.

SPEAKER_01 (00:09):
Today we're gonna talk about the new guidelines by
the European Data ProtectionBoard on Anonymization that have
a massive impact on artificialintelligence.

SPEAKER_00 (00:19):
And we're gonna make it during the time of a coffee
break.
So, Julio, on July 7, 2026, theADPB adopted the draft guidance
on anonymization.
It's the first real update since2014.
So, what's actually new?

SPEAKER_01 (00:38):
It was um an update that was highly expected because
um technology has changed.
It is true that what waspersonal data over 10 years ago
is um still personal data, butwasn't personal data at that
time, maybe is personal data nowbecause of uh the technology
that is uh more powerful.

(01:00):
At the same time, the case lawhas uh substantially evolved.
The milestone that is morerelevant for these guidelines is
uh not only the development ofartificial intelligence, but the
what was normally called as theDeloitte uh decision of the

(01:20):
European Court of Justice thatintroduced a concept of um
subjective assessment of what ispersonal data.

SPEAKER_00 (01:29):
And so, Julio, what is the subjective analysis of
personal data?

SPEAKER_01 (01:32):
Well, so far the position of European data
protection authorities was umyou need to make sure that uh
directly or indirectly, no onecan link that information to an
individual.
When uh we were referring to noone, was really no one, no one
in the world that was definitelytoo broad, there was a concept

(01:54):
of uh reasonableness, but it wasvery blurred.
For a company like Google, somecould argue basically any
information is personal databecause of the massive amount of
data that they uh have about us.
Uh but after the Deloittedecision of the European Court
of Justice, it was validatedthat you need to have a look at

(02:16):
uh the position of the entityprocessing that data, not the
rest of the world, and whetherthat entity has reasonably in
its hands the information ableto link the information received
to the relevant individual.
If that information cannot belinked, then we're not

(02:39):
processing personal dataanymore.
Obviously, that needs to bereassessed with the evolution of
the technology.
It's um a burden of proof thatis on the entity processing
data.
But this is really importantbecause um until now, basically
you had to look at theperspective of whoever could

(03:00):
have in its hands thatinformation, which definitely
was too broad to be assessed.

SPEAKER_00 (03:07):
And the ADPB relies on three criteria singling out,
linkability, and inference.
Uh, which of these is thehardest for AI systems to
satisfy and why does AI changethe equation here?

SPEAKER_01 (03:18):
Well, the inference is the most tricky element
because um directly orindirectly, I don't have to be
able to link that information tothe relevant um individual.
We know that uh artificialintelligence is so powerful
because it can process a massiveamount of personal data.

(03:39):
But then uh if uh, for example,we refer to the identification
code of a client of a bank, thatinformation is in the ends of
the bank, but for the rest ofthe world, it's not the
information of an individual.
Or uh uh same thing for the IBANnumber.
That information is for my bank,linked to my bank account, but

(04:02):
probably the rest of the worlddoesn't know much uh about that
number is not able to link thatto an individual.
But this has massive umimplications, for instance, when
it comes to medical trials.
In that case, patients areidentified through an
identification code that uh isunique, that's true, but the uh

(04:25):
table able to link that patientto the relevant um code is just
in the hands of the hospital.
Then you need to understandwhether through the other
information in the hands of thethird party the inference is
still possible, it's uh stillpossible to link that
information to the relevantindividual.

(04:46):
But you know, uh while in thepast uh the test was quite uh
simple, straightforward, if adda code that directly and
indirectly potentially couldhave been linked to an
individual, then thatinformation was a personal data,
now it's uh a completelydifferent perspective.

SPEAKER_00 (05:05):
The ADPB also says that anonymization isn't a
one-time check.
It has to be reassessedperiodically as
ray-identification techniquesimprove.
Um, what should companiesbuilding or deploying AI systems
actually change starting now?

SPEAKER_01 (05:21):
Antonio, this is the trickiest element.
It is true that uh technologyevolves, especially in the last
years.
Uh, we have had a look how AIsystems have been quickly
evolving.
We're doing now something thatuh was uh totally uh
unforeseeable two years ago.
Having uh your database isinformation that now is not

(05:45):
personal data and might becomepersonal data makes uh the
burden for companies processingthat information very hard to
manage because um then I shouldrun a sort of audit on that uh
information periodically, anduh, what is the time span that
uh is relevant?

(06:05):
It might be a year, but itreally depends because in a year
at the age of AI the perspectivecould be completely changed.
So definitely companies need toput in place a procedure to
reassess anonymization.
How long the assessment has tobe performed should be analyzed
periodically based on theevolution of the technologies.

SPEAKER_00 (06:29):
The public consultation stays open until
October 30, 2026.
If an organization has time forjust one concrete action before
then, what should it be?

SPEAKER_01 (06:39):
What I do believe is more relevant is to have uh the
concept of anonymization moreprecise, more straightforward,
because I need to be certainthat I'm not processing personal
data.
It is true that um rules aroundprivacy are principle-based, so
there will be uh no case wherethere is a situation of black or

(07:04):
white, but companies in order torun the business need rules that
are more precise.
So there should be a sort ofshift from a purely principle
based methodology to somethingthat uh companies can more
easily implement in theiroperations so that once the test
is completed, then they can moveforward more easily.

SPEAKER_00 (07:27):
Thank you, Julia.
Thank you very much.

SPEAKER_01 (07:29):
Thank you, Antonio.
Arrived