The EDPB publishes guidelines on anonymization, web scraping for generative AI, and finalizes its recommendations on blockchain
The European Data Protection Board (EDPB) has adopted several guidelines concerning anonymization, web scraping for generative artificial intelligence, as well as the final version of its guidelines on blockchain technologies.
The new guidelines on anonymization aim to clarify the concept of anonymous data, taking into account notably the judgment of the Court of Justice of the European Union in case C-413/23 P of 4 September 2025. Data is considered anonymous if it does not relate to an identified or identifiable natural person. The document proposes a practical framework to assess whether anonymization is successful, based on a contextual or simplified approach, relying on three criteria: the absence of isolation of a record, the absence of linkage, and the absence of inference. These guidelines are subject to a public consultation until 30 October 2026.
The EDPB has also published guidelines on web scraping in the context of generative artificial intelligence, clarifying the obligations under the GDPR. The document recalls that the GDPR applies whenever personal data is processed and emphasizes compliance with the principles of purpose limitation and transparency, while specifying the conditions under which a controller may be exempted from informing individuals personally. Regarding the processing of special categories of data, it is recalled that a legal basis under Article 6 of the GDPR and an exception under Article 9, paragraph 2, of the GDPR are necessary, with judgment C-136/17 potentially relevant for incidental or residual collection. This draft is also open to public consultation until 30 October 2026.
Finally, the EDPB has adopted the final version of its guidelines on blockchain technologies, following a public consultation. These aim to assist organizations in complying with the GDPR when using these technologies. They analyze the different possible architectures and their implications for the processing of personal data. A report on the consultation results and a version with tracked changes have also been published.
The new guidelines on anonymization aim to clarify the concept of anonymous data, taking into account notably the judgment of the Court of Justice of the European Union in case C-413/23 P of 4 September 2025. Data is considered anonymous if it does not relate to an identified or identifiable natural person. The document proposes a practical framework to assess whether anonymization is successful, based on a contextual or simplified approach, relying on three criteria: the absence of isolation of a record, the absence of linkage, and the absence of inference. These guidelines are subject to a public consultation until 30 October 2026.
The EDPB has also published guidelines on web scraping in the context of generative artificial intelligence, clarifying the obligations under the GDPR. The document recalls that the GDPR applies whenever personal data is processed and emphasizes compliance with the principles of purpose limitation and transparency, while specifying the conditions under which a controller may be exempted from informing individuals personally. Regarding the processing of special categories of data, it is recalled that a legal basis under Article 6 of the GDPR and an exception under Article 9, paragraph 2, of the GDPR are necessary, with judgment C-136/17 potentially relevant for incidental or residual collection. This draft is also open to public consultation until 30 October 2026.
Finally, the EDPB has adopted the final version of its guidelines on blockchain technologies, following a public consultation. These aim to assist organizations in complying with the GDPR when using these technologies. They analyze the different possible architectures and their implications for the processing of personal data. A report on the consultation results and a version with tracked changes have also been published.
Informations complémentaires
L’analyse complète est réservée aux membres
Montant de la sanction, thèmes, secteurs, entités et données concernées : l’essai gratuit de 14 jours ouvre la fiche entière et la veille personnalisée.
Essayer gratuitement 14 jours · accès complet · sans carte bancaire