New EDPB guidelines on pseudonymization

These are the main outcomes of the January 16 EDPB plenary session.

Guidelines on pseudonymization

Pseudonymizing is a security measure. By pseudonymizing personal data, they are more difficult to trace back to individuals. And that makes the impact smaller in the event of a data breach, for example.

The guidelines consist of two parts: a section on the legal questions surrounding pseudonymization, and a section on the technical aspects.

• The legal section includes a focus on reducing the risks of processing by pseudonymizing data. It is then more likely that processing can take place on the basis of legitimate interest.

• The technical section includes what technical measures an organization can take to prevent data that should not be linked from actually being linked.

These guidelines are not yet final. Anyone who wishes to do so may, through February 28, 2025 respond to the guidelines via the EDPB website.. After this consultation, the EDPB will adopt the final guidelines.

Position paper on privacy and competition

The position paper on the interaction between data protection and competition law deals with the cooperation between privacy and competition regulators - in the Netherlands, the Personal Data Authority (AP) and the Consumer and Market Authority (ACM). The EDPB makes concrete recommendations for better cooperation between regulators. For example, laying down agreements in a cooperation protocol.

The reason for this position paper is a 2023 ruling of the Court of Justice of the European Union.. The Court then ruled that regulators in these two areas must work together to supervise effectively and consistently. Because even though these are two separate areas of law with their own goals and enforcement, often the rules from data protection and competition law apply to the same companies and even to the same activities.

The Personal Data Authority (AP) is one of the privacy regulators in the EDPB.