German BfDI Initiates Public Consultation Process Regarding Anonymization Under The GDPR

German BfDI Initiates Public Consultation Process Regarding Anonymization Under The GDPR

The German Federal Commissioner for Data Protection and Freedom of Information (BfDI) recently announced a public consultation process regarding anonymization under the European Union General Data Protection Regulation (GDPR) that is intended to provide the BfDI’s position regarding the legal framework for anonymizing personal data and to solicit and evaluate public comments on the topic. The BfDI guidance resulting from the consultation will be helpful since European data protection authorities have not provided any in depth guidance regarding requirements for anonymization under the GDPR.

IN DEPTH


On February 10, 2020, the German Federal Commissioner for Data Protection and Freedom of Information (BfDI) announced a public consultation process regarding anonymization under the European Union (EU) General Data Protection Regulation (GDPR) and, in particular, anonymization within the telecommunications sector. The purpose of the consultation is to provide the BfDI’s position regarding the legal framework for anonymizing personal data and to solicit and evaluate public comments. Stakeholders may submit comments to the BfDI through March 9, 2020.

In the announcement of the consultation process, the BfDI focuses on the requirements for determining that data is anonymous data rather than personal data (which includes pseudonymous data) regulated by the GDPR and the need for a legal basis for processing of personal data into anonymous data. Even though the BfDI is the supervisory authority only for telecommunication providers and German federal authorities, the updated BfDI guidance regarding these two matters will be helpful since there is scant direction in the GDPR and from data protection authorities regarding requirements for anonymization. Instead, data controllers and processors often seek guidance from Article 29 Data Protection Working Party (Working Party) opinions under the EU Privacy Directive that were adopted prior to the May 25, 2018 GDPR effective date and are not included among the Working Party opinions adopted by the European Data Protection Board.

Leave a Reply

Your email address will not be published. Required fields are marked *