EDPB Redefines Digital Frontiers with New Guidelines on Anonymization AI Web Scraping and Blockchain Technology

The European Data Protection Board (EDPB) has released a comprehensive suite of new guidelines designed to modernize the European Union’s approach to data privacy in the age of generative artificial intelligence and decentralized ledger technologies. This regulatory overhaul represents the most significant update to the interpretation of the General Data Protection Regulation (GDPR) in several years, specifically targeting the complexities of data anonymization, the aggressive harvesting of data for AI training, and the inherent contradictions between blockchain immutability and the "right to be forgotten." As the digital landscape shifts toward increasingly autonomous systems, the EDPB’s latest pronouncements provide a much-needed roadmap for organizations, legal professionals, and technology developers who must navigate the fine line between innovation and the fundamental right to privacy.

The Evolution of Anonymization: Moving Beyond the 2014 Framework

For over a decade, the gold standard for understanding anonymous data in the EU was the Opinion 05/2014 issued by the Article 29 Working Party (G29). However, as computational power has increased and data science techniques have become more sophisticated, the 2014 framework began to show its age. The new Guidelines 02/2026 serve as a direct successor, recalibrating the definition of anonymous data to align with the latest jurisprudence from the Court of Justice of the European Union (CJEU).

The core of the new guidance rests on three cumulative criteria used to determine if data has been truly anonymized: individualization (the ability to single out a person in a dataset), correlation (the ability to link different records relating to the same person), and inference (the ability to deduce information about a person with a high degree of probability). The EDPB emphasizes that anonymization is not a "one-and-done" technical process but a continuous evaluation. Organizations must now adopt a "perspective" approach, assessing the risk of re-identification based on the specific capabilities and resources available to both the data controller and potential third parties.

Critically for the healthcare and research sectors, the EDPB has confirmed that the act of anonymization itself constitutes a "processing" activity. This means that before an organization can even begin to strip personal identifiers from a dataset, it must have a valid legal basis under Article 6 of the GDPR. When dealing with sensitive health data, the requirements are even more stringent; the process must satisfy one of the specific exceptions listed in Article 9. This clarification closes a long-debated loophole where some entities argued that the transition from personal to anonymous data existed in a legal vacuum.

Web Scraping and the Generative AI Training Conflict

As generative AI models like Large Language Models (LLMs) require astronomical amounts of data for training, "web scraping"—the automated extraction of data from the public internet—has become a flashpoint for privacy regulators. The EDPB’s new guidelines on scraping provide a stern reminder that the "public" nature of data does not exempt it from GDPR protections. The board asserts that the regulation applies at every stage of the AI pipeline: from initial collection and storage to organization and final extraction.

The guidelines provide a detailed analysis of "legitimate interest" (Article 6(1)(f)) as a legal basis for scraping. Following its December 2024 opinion on AI models, the EDPB insists that companies must demonstrate that their interest in training a model does not override the fundamental rights of the individuals whose data is being harvested. This is particularly difficult when scraping occurs "behind the backs" of users, violating principles of transparency and purpose limitation.

The sensitivity of health data (Article 9) remains the most significant hurdle for AI developers. The EDPB clarifies that scraping datasets that may contain health information—even if such information is collected incidentally or residually—is generally prohibited unless a specific legal exception is met. Referencing the GC e.a. case (C-136/17), the board notes that while some incidental collection might be permissible under strict conditions, there is no "blanket exemption" for AI training. Developers must implement robust technical and organizational measures to prevent the capture and dissemination of sensitive categories of data.

For healthcare institutions, this creates a new layer of due diligence. While hospitals are rarely the entities performing the scraping, they are increasingly the consumers of AI tools built on scraped data. Chief Information Officers (CIOs) and Data Protection Officers (DPOs) are now expected to audit their AI vendors, using the EDPB’s guidelines as a checklist to ensure the provenance of training data is legally sound and ethically sourced.

Blockchain Technology: Reconciling Immutability with Privacy

After a lengthy period of public consultation, the EDPB has finalized its guidelines on the processing of personal data through blockchain and other distributed ledger technologies. The fundamental tension in this space is the "immutability" of the blockchain—its design to never delete or alter records—which stands in direct opposition to the GDPR’s "right to erasure" and the principle of data minimization.

The final text provides a taxonomy of blockchain architectures, from public permissionless chains to private permissioned ones, and explains how the role of "data controller" is assigned in each. One of the most significant takeaways is the board’s stance on hashing and encryption. The EDPB maintains that hashed data often still qualifies as personal data (pseudonymous) rather than anonymous data, especially if the original data can be reconstructed or linked back to an individual.

In the healthcare sector, blockchain is often touted as a solution for tracking patient consent or ensuring the integrity of pharmaceutical supply chains. The EDPB’s guidelines suggest that while these use cases are valuable, they must be designed with "privacy by design" at their core. For instance, storing actual health data on a chain is highly discouraged; instead, the board suggests using the blockchain as a ledger for metadata or proofs of transactions, while the actual sensitive data remains in off-chain, erasable storage systems. This version of the guidelines also includes a comparative report of modifications made following the public consultation, reflecting a commitment to the "Helsinki Declaration" on dialogue with technological stakeholders.

Chronology of Regulatory Development

The release of these guidelines is the culmination of several years of legal shifts and technological advancements. To understand the current landscape, it is essential to look at the timeline of events that led to this moment:

• April 2014: The G29 releases Opinion 05/2014, establishing the original criteria for anonymization.
• May 2018: The GDPR becomes fully enforceable, introducing stricter penalties and the "right to be forgotten."
• October 2023 – early 2024: The CJEU issues several rulings (including cases involving the Single Resolution Board) that refine the definition of "personal data" in the hands of different recipients.
• December 2024: The EDPB issues its first major opinion on the intersection of Large Language Models and GDPR compliance.
• Late 2025: Draft versions of the anonymization and scraping guidelines are circulated for initial feedback.
• February 2026: The EDPB finalizes the Blockchain guidelines and opens the public consultation for the updated Anonymization and Scraping texts.
• October 30, 2026: The deadline for stakeholders to submit contributions to the ongoing consultation process.

Analysis of Implications for the Tech and Health Sectors

The implications of these guidelines are far-reaching. For the technology sector, the EDPB is signaling that the era of "move fast and break things" with regard to public data is over. Companies that rely on scraping must now invest heavily in filtering technologies and transparent communication with data subjects. The "accuracy" requirement highlighted by the board—requiring reliable sources, time-stamping, and data validation before training—will likely increase the operational costs of developing generative AI in Europe.

In the healthcare industry, the focus on Article 9 exceptions for the act of anonymization will require a shift in how research projects are structured. It is no longer enough to assume that a project is "safe" just because the final output is anonymous. The journey to that anonymity must be documented, justified, and legally grounded. This may lead to a greater reliance on "Synthetic Data"—data generated by algorithms that mimic the statistical properties of real datasets without containing information from any actual individual—as a way to bypass the hurdles of processing real patient records.

Furthermore, the audit trail for AI tools in hospitals will become more rigorous. DPOs will likely demand "Transparency Reports" from AI vendors that detail not just the accuracy of the model, but the legal basis for every gigabyte of data used in its training corpus.

Looking Ahead: The October 30 Deadline

As the EDPB moves toward stabilizing these texts, a window of opportunity remains for the industry to influence the final outcome. The public consultation, open until October 30, 2026, allows digital health federations, AI startups, and privacy advocates to voice their concerns. Stakeholders are expected to argue for more practical implementations of the "inference" criterion in anonymization and for clearer boundaries on what constitutes "incidental" collection during web scraping.

The final versions of these documents will encase the European digital economy in a framework that prioritizes human rights over unbridled data extraction. While some industry groups argue that these strictures could put Europe at a disadvantage compared to the US or China, the EDPB’s position remains firm: sustainable innovation in the 21st century cannot be built on the erosion of individual privacy. As the consultation period progresses, the dialogue between regulators and innovators will be the defining factor in how Europe’s digital future is written.