On July 7, the European Data Protection Board adopted draft guidelines addressing a consequential question: when does information qualify as anonymous and fall outside the GDPR? The consultation opened the following day and remains open through October 30, 2026.
Calling data anonymous is easy. Explaining what supports that conclusion takes more work. The draft makes that work easier to understand by connecting the legal question to a structured technical assessment.
Its contribution is practical: an anonymity claim becomes easier to examine when the assessment identifies the questions asked, the methods used, and what the results establish.
Three Questions Make the Assessment Concrete
The draft’s technical framework uses three criteria. No Record Isolation examines unique combinations of individual attributes. No Linkage examines connections between records across datasets. No Inference examines meaningful, specific deductions about individuals.
Section 3.4 defines each criterion and Section 3.5 applies them, through worked examples and an assessment process. Passing all three supports anonymity; failing one requires further analysis rather than automatically establishing personal data.
These questions help separate tasks that are easily collapsed into a single assurance. Removing a name addresses the name. The remaining information still needs examination.
Consider a hypothetical research dataset whose creators replace names with random labels. It contains individual patients’ ages, locations, and detailed clinical histories. An assessor could begin by examining whether particular combinations occur only once. That would answer a question about the records in this dataset. It would not, by itself, establish that anyone can identify those patients.
A separate inquiry would examine matching information elsewhere. Another would examine what can be deduced from the data. Keeping those inquiries distinct makes the reasoning easier to follow and the conclusion easier to challenge.
The Assessment Depends on What People Can Actually Do
The draft distinguishes a contextual assessment of relevant parties’ capabilities from a more conservative simplified approach, which it describes as a practical choice rather than an alternative legal standard. It considers accessible additional information, data detail and diversity, population size, and identification methods’ precision and reliability. It also addresses evolving capabilities and safety margins.
In our hypothetical example, the assessor therefore needs to explain the assumed setting. Is the dataset being published for anyone to download? Is it available only to specified researchers? What information can those researchers obtain?
A conclusion based on restricted access needs a connection to those restrictions. If the organization later publishes the data openly, it should not assume the original reasoning still describes the release.
This is a lesson we draw from the framework: the label should travel with an explanation of the conditions supporting it. Without those conditions, a recipient cannot tell what the assessment actually established.
Technical Guidance Makes Documentation More Useful
The draft supplies an assessment pathway, not a universal numerical pass score or mandatory algorithm. Its examples include aggregate outputs and distinguish effective inference from unsupported guessing. A flowchart brings the assessment steps together.
For an organization implementing that approach, useful documentation would identify the data examined, the relevant parties, the methods tested, and the evidence supporting the result. It would also explain assumptions and limitations. That is a practical application of the framework, rather than a prescribed report template.
Such documentation gives reviewers something substantive to examine. They can ask why a particular matching method was selected, whether an important data source was omitted, and whether the conclusion remains within the evidence.
The expertise still matters. The framework helps make the expert’s reasoning accessible to the people who must decide whether to rely on it.
United States Resources Provide a Useful Comparison
HIPAA already allows de-identification by Expert Determination, alongside the separate Safe Harbor method. OCR’s established guidance requires documented methods and results and addresses anticipated recipients, linkage, and changing conditions. It does not prescribe a universal assessment method.
Technical resources also exist beyond OCR. NIST’s De-Identifying Government Datasets (SP 800-188) addresses techniques and governance. Its 2025 differential privacy guidance (SP 800-226) explains a mathematical framework for quantifying privacy loss and practical implementation hazards. These resources do not themselves establish compliance with HIPAA.
The European draft therefore offers an additional way to organize an assessment. It does not supply a substitute for the United States legal standard. Its value for readers outside Europe is the clarity with which it connects questions about identification to technical examination.
