Anonymisation des données, un cadre complété et opérationnel !

The European Data Protection Board (EDPB) has officially released Guidelines 02/2026, a landmark document that provides long-awaited clarity on the concept of anonymization within the framework of the General Data Protection Regulation (GDPR). This new guidance significantly refines the standards first established by the Article 29 Working Party in 2014, incorporating over a decade of technological evolution and pivotal rulings from the Court of Justice of the European Union (CJEU). By moving away from the pursuit of absolute, irreversible impossibility and toward a risk-based "likelihood test," the EDPB has established a more pragmatic yet rigorous threshold for what constitutes truly anonymous data. This development is poised to redefine how industries—ranging from healthcare and pharmaceutical research to the training of large-scale artificial intelligence (AI) models—handle sensitive information in an increasingly interconnected digital ecosystem.

The Evolution of Anonymization: From Theory to Practice

For years, the legal definition of anonymization remained a point of contention among privacy professionals, data scientists, and regulators. The core of the debate centered on whether data could ever be considered truly anonymous if there remained even a microscopic mathematical possibility of re-identification. The 2014 Opinion (WP216) set a high bar, focusing on the prevention of identification by all "means reasonably likely to be used." However, Guidelines 02/2026 refine this by integrating recent CJEU jurisprudence, most notably the judgment in Case C-413/23 (EDPS v. CRU).

The new guidelines confirm that the analysis of re-identification risk must consist of a "vraisemblance" or likelihood test. This objective assessment considers several factors: the intrinsic properties of the data, the context of its dissemination, the availability of additional information, the cost and time required for re-identification, and the current state of technology. Crucially, the EDPB clarifies that legal prohibitions on access only mitigate risk if they are effectively enforced; contractual "non-disclosure" agreements alone are insufficient to transform personal data into anonymous data.

Perhaps the most innovative shift is the formal recognition of the "perspective" approach. The EDPB acknowledges that the status of a dataset—whether it is personal or anonymous—can vary depending on the entity holding it. A dataset may be considered anonymous for a third-party recipient who lacks any means of re-identification, while simultaneously remaining personal data for the original controller who retains the "matching key." This nuanced view provides a pathway for secure data sharing while ensuring that the entity with the power to re-identify remains bound by the full weight of GDPR obligations.

A Chronology of Data Protection Standards in Europe

To understand the weight of the 02/2026 Guidelines, one must look at the timeline of European data protection evolution:

• 1995 (Directive 95/46/EC): The original Data Protection Directive introduces the concept of anonymization in Recital 26, stating that protection principles do not apply to data rendered anonymous.
• 2014 (WP216 Opinion): The Article 29 Working Party publishes its opinion on anonymization techniques, establishing the three pillars of risk: individualization, correlation, and inference.
• 2018 (GDPR Enforcement): The General Data Protection Regulation enters into force, codifying anonymization as a state where the data subject is no longer identifiable.
• 2023–2025 (Pivotal Jurisprudence): Rulings such as C-413/23 clarify that the "reasonableness" of re-identification must be assessed from the perspective of the data holder and third parties, moving away from an abstract "universal" anonymity.
• July 2026 (EDPB Guidelines 02/2026): The EDPB adopts the current guidelines, consolidating case law and providing a technical roadmap for the AI era.

The Three Pillars of Anonymization: Refined Criteria

The EDPB has maintained the three historical criteria for evaluating anonymization but has provided significant technical refinements for each.

1. No Record Isolation (Individualization)

This criterion dictates that a dataset must not allow for the singling out of an individual. If a data entry contains a unique combination of attributes—such as a rare medical condition combined with a specific zip code and age—that allows a person to be identified within the group, the data is not anonymous. The 2026 guidelines emphasize that "high-dimensionality" data (data with many variables) is particularly vulnerable to isolation.

2. No Linkage (Correlation)

Linkage refers to the ability to connect at least two records concerning the same data subject, either within the same dataset or across different databases. The EDPB notes that the proliferation of "open data" and public social media profiles has made linkage significantly easier for malicious actors. Effective anonymization must ensure that such "cross-referencing" is not reasonably possible.

3. No Inference

The most significant refinement in the 2026 guidelines concerns the "inference" criterion. The EDPB now distinguishes between "specific and significant" inference and "general" inference.

• Specific and Significant Inference: This occurs when a third party can deduce sensitive information about a specific individual within the dataset, potentially affecting their rights and interests. This constitutes a violation of the anonymization standard.
• General Inference: This refers to purely statistical patterns (e.g., "people in this city tend to prefer X product") that do not link back to a specific person. The EDPB clarifies that general statistical inference does not disqualify a dataset from being considered anonymous—a major win for the research and AI sectors that rely on trend analysis.

Anonymization as a Regulated Processing Activity

One of the most impactful sections of Guidelines 02/2026 is the confirmation that the act of anonymizing data is itself a "processing" activity under Article 4(2) of the GDPR. This means that before a controller can even begin the process of turning personal data into anonymous data, they must have a valid legal basis under Article 6 (and Article 9 for sensitive data).

For most organizations, the legal basis for anonymization will coincide with the basis for the original data collection, provided the anonymization is a compatible purpose (often cited under scientific research or legitimate interests). However, the EDPB imposes strict transparency and documentation requirements. Organizations are now explicitly forbidden from using terms like "anonymous" or "de-identified" in a misleading manner if there remains a reasonable risk of re-identification. Furthermore, the process must be documented through a formal "Anonymization Impact Assessment," including the results of "stress tests" designed to attempt re-identification.

Technical Factors and the Challenge of Mixed Datasets

The guidelines introduce a structured decision tree for assessing the efficacy of anonymization techniques. Key factors include:

• Aggregation: Whether data is presented in groups or individually.
• Resolution: The level of detail (e.g., exact age vs. age brackets).
• Diversity: The variety of attributes within the dataset.
• The "Mosaic Effect": The risk that multiple "anonymous" datasets, when combined, become personal data.

The EDPB also addresses "mixed datasets"—collections containing both anonymous and personal data. The Board’s stance is clear: if the personal and anonymous elements cannot be effectively segregated, the entire dataset must be treated as personal data and handled according to the full rigors of the GDPR.

Implications for AI and Future Technology

The release of these guidelines comes at a critical juncture for the development of Artificial Intelligence. AI models require massive volumes of data for training, often involving sensitive personal information. By providing a clearer path to "anonymity," the EDPB is offering a framework for "Privacy-Preserving Machine Learning."

However, the Board warns of "Agentic AI" and the rapid advancement of computing power, which may render today’s anonymization techniques obsolete tomorrow. Consequently, the guidelines recommend a "periodic re-evaluation" of anonymized data. Anonymity is no longer viewed as a permanent "set-and-forget" state but as a dynamic status that must be monitored against the evolving technological landscape.

Reactions and Broader Impact

While official reactions from the tech industry are still emerging, early analysis from legal experts suggests a "cautious welcome." Privacy advocates praise the EDPB for closing loopholes regarding "inference" and for mandating that anonymization be treated as a regulated process. Meanwhile, data-driven enterprises are relieved by the "perspective" approach, which allows for more flexible data-sharing arrangements in research consortia.

The implications for the healthcare sector are particularly profound. As medical research moves toward personalized medicine, the ability to share "anonymized" genomic or clinical data across borders is essential. The EDPB’s refined criteria provide a safer legal harbor for these activities, provided that researchers implement the "contextualized approach" to risk assessment.

In conclusion, Guidelines 02/2026 represent a sophisticated balancing act. They acknowledge the impossibility of zero risk in the digital age while providing a robust methodology to minimize that risk to a "reasonable" level. For organizations operating within the EU, the message is clear: anonymization is a powerful tool for data utility, but it requires continuous vigilance, legal rigor, and technical excellence. As the data economy continues to grow, these guidelines will serve as the essential blueprint for protecting fundamental rights without stifling the innovation that drives the modern world.