Anonymisation des données, un cadre complété et opérationnel !

The European Data Protection Board (EDPB) has officially released Guidelines 02/2026, a comprehensive update to the regulatory framework governing data anonymization within the European Union. This new guidance arrives over a decade after the previous standards set by the Article 29 Working Party in 2014, reflecting a radical shift in the technological landscape, particularly the rise of high-dimensional data analytics and agentic artificial intelligence. The updated document clarifies the legal threshold for anonymity, refines the methodology for assessing re-identification risks, and cements the principle that the process of anonymization itself is a data processing activity subject to the strictures of the General Data Protection Regulation (GDPR). By integrating recent jurisprudence from the Court of Justice of the European Union (CJEU), the EDPB has moved away from a requirement of absolute impossibility of re-identification toward a more nuanced "test of likelihood," while simultaneously imposing stricter documentation and transparency obligations on data controllers.

The Evolution of Anonymization: From Absolute Impossibility to Likelihood

Central to the 2026 Guidelines is a refined conceptualization of what constitutes "anonymous" data. For years, legal and technical experts debated whether data could only be considered anonymous if it were impossible for anyone, under any circumstances, to re-identify the underlying data subjects. The EDPB has now clarified this by aligning with the CJEU’s judgment in Case C-413/23 (EDPS v. CRU), which emphasizes that the risk of re-identification must be assessed based on "means reasonably likely to be used."

This shift introduces a "test of likelihood" rather than a standard of "absolute impossibility." Under this framework, a risk assessment must account for objective factors such as the intrinsic properties of the data, the context of its dissemination, the availability of additional information, the costs and time required for re-identification, and the current state of technology. The EDPB explicitly notes that "means" should be interpreted broadly, encompassing everything from simple internet searches and document reviews to complex algorithmic analysis and the utilization of third-party resources.

Furthermore, the guidelines introduce the "perspective-based" approach to anonymity. This is perhaps the most significant departure from earlier doctrines. The EDPB acknowledges that the status of data—whether it is personal or anonymous—can depend on the entity holding it. A dataset may be considered anonymous in the hands of a third party that lacks any "key" or supplementary information to link records to individuals, even if that same dataset remains personal data in the hands of the original controller who retains the means of re-identification. This relative approach provides much-needed clarity for data-sharing agreements, particularly in research and healthcare sectors.

Refining the Three Historical Criteria: Isolation, Linkage, and Inference

The EDPB has reaffirmed the three core criteria established in 2014 for evaluating the effectiveness of anonymization techniques: isolation (individualization), linkage (correlation), and inference. However, the 2026 Guidelines provide significantly more granular detail on how these should be applied in a modern data environment.

1. No Record Isolation: This criterion dictates that a dataset should not allow for the singling out of an individual. In the age of "Big Data," this is increasingly difficult. The EDPB warns that even if names and direct identifiers are removed, a unique combination of attributes—such as a specific birth date, a rare medical condition, and a specific postal code—can still isolate a record.
2. No Linkage: This requires that it must be impossible to link two or more records relating to the same data subject, whether within the same dataset or across different databases. The guidelines highlight the "mosaic effect," where disparate pieces of anonymous data can be combined to form a clear picture of an individual’s identity.
3. No Inference: The most complex of the three, the inference criterion, has been clarified to distinguish between "specific and significant inference" and "general inference." Anonymization is only considered compromised if the inference is specific enough to be linked to a particular individual and significant enough to affect their rights or interests. Statistical inferences that describe general trends within a population without enabling the identification of a specific person do not necessarily violate this criterion. This distinction is crucial for the development of AI models, which rely on identifying patterns across large populations.

Anonymization as a Regulated Processing Activity

A pivotal clarification in the 2026 Guidelines is the explicit statement that the act of anonymizing personal data is, in itself, a processing activity. This means that a data controller cannot simply decide to anonymize a dataset without first establishing a valid legal basis under Article 6 of the GDPR. If the data involves special categories, such as health or genetic data, a derogation under Article 10 or Article 9(2) is also required.

This prevents "dark processing," where organizations might claim they are "preparing" data for anonymization as a way to circumvent data retention limits. The EDPB suggests that the legal basis for anonymization will often coincide with the original purpose of the data collection, provided the anonymization is part of the same processing activity and serves compatible purposes, such as scientific research.

The guidelines also introduce a mandatory documentation requirement. Organizations must now document the entire anonymization process, including the technical techniques used (such as noise addition, permutation, or k-anonymity) and the results of re-identification stress tests. Furthermore, the EDPB prohibits the misleading use of terms like "anonymous" or "de-identified" in privacy notices if the data subjects remain reasonably identifiable.

Chronology of Anonymization Guidance and Legal Precedents

To understand the weight of the 02/2026 Guidelines, it is essential to view them within the historical timeline of European data protection law:

• April 2014: The Article 29 Working Party publishes Opinion 05/2014 on anonymization techniques. This becomes the gold standard for a decade but lacks the context of the GDPR (which was then only a draft).
• May 2018: The GDPR enters into full force, introducing stricter definitions of personal data and pseudonymization, but leaving "anonymization" largely to Recital 26.
• 2020-2023: Rapid advancements in AI and the proliferation of data brokers increase the difficulty of maintaining "true" anonymity, leading to calls for updated guidance.
• September 2025: The CJEU rules in Case C-413/23 (EDPS v. CRU). The court establishes that data is not personal if the recipient has no legal or practical means to access the information required for re-identification.
• July 2026: The EDPB adopts Guidelines 02/2026, incorporating the CJEU’s "perspective" approach and addressing modern technical challenges.

Supporting Data and Technical Context

The need for these refined guidelines is underscored by the increasing vulnerability of traditional anonymization methods. Research in the field of computational privacy has shown that in high-dimensional datasets—such as those containing location data or browsing histories—removing direct identifiers is rarely sufficient. A study frequently cited by privacy researchers demonstrated that 87% of the U.S. population could be uniquely identified using only three attributes: ZIP code, gender, and date of birth.

The EDPB’s 2026 guidance acknowledges these realities by introducing an "evaluation matrix" for the effectiveness of anonymization. This matrix considers:

• Granularity: The level of detail in the data.
• Dimensionality: The number of attributes per record.
• Diversity: The range of values within those attributes.
• Population Size: The total number of individuals in the dataset.

The guidelines explicitly warn that "individual-level data with high dimensionality and high resolution" are the most vulnerable to re-identification, even when sophisticated masking techniques are applied.

Broader Implications for AI and Industry

The implications of the 02/2026 Guidelines are far-reaching, particularly for the burgeoning AI industry. As developers seek massive datasets to train Large Language Models (LLMs) and agentic AI systems, the ability to use "truly anonymous" data provides a significant regulatory advantage: anonymous data is not subject to GDPR restrictions on storage, transfer, or purpose limitation.

However, the EDPB’s insistence on "periodic re-evaluation" introduces a new operational burden. Because the "reasonable means" for re-identification evolve as computing power increases and AI itself becomes more adept at pattern matching, a dataset that is anonymous today may become personal data tomorrow. Controllers are now recommended to conduct regular audits of their anonymous datasets, especially following security incidents or significant technological leaps.

Industry reactions have been mixed. While privacy advocates welcome the clarity on "inference" and the "processing activity" designation, business groups have expressed concern over the "perspective" approach. Some argue that having the same data classified as "anonymous" for one party and "personal" for another could create complex liability chains in data-sharing ecosystems.

Conclusion: A Framework for the Future

The EDPB Guidelines 02/2026 represent a sophisticated attempt to balance the competing interests of data-driven innovation and fundamental privacy rights. By moving away from an impossible standard of absolute anonymity and toward a risk-based, contextual assessment, the EDPB has provided a more realistic path for organizations to follow. Yet, by classifying anonymization as a regulated process and requiring ongoing vigilance against technological progress, the Board has signaled that anonymity is no longer a "set-and-forget" state, but a continuous commitment to data protection. As the public consultation period for these guidelines concludes, the focus will shift to how national supervisory authorities will enforce these rigorous new standards in an increasingly automated world.