EDPB adopts anonymisation guidelines — 'strip the names' is no longer enough
At its 8 July plenary the EDPB adopted Guidelines 02/2026 on anonymisation, replacing the old 2014 working definition and folding in the CJEU ruling in C-413/23 P (EDPS v SRB, Sept 2025). Data is only anonymous if it passes three tests: no singling-out, no linkability, and no inference. The inference test is the one that bites AI — if attributes of a person can be inferred with high probability from the remaining values, the data stays personal data and GDPR applies in full, regardless of how many identifying fields you deleted. Practical take for anyone training or deploying models: the common assumption that a de-identified training set sits outside GDPR is now formally closed. Re-identification risk has to be assessed against modern attacker capability, including AI's cross-referencing and pattern-extraction power. Open for consultation to 30 October 2026.
Source: European Data Protection Board
EDPB guidelines on web scraping for generative AI: legitimate interest is not a free pass
Alongside the anonymisation guidelines, the EDPB adopted separate guidelines on web scraping in the context of generative AI. The message to model builders is direct: scraping that touches personal data is GDPR processing (collection, storage, organisation, retrieval), so you need a lawful basis, and legitimate interest only holds up if you can evidence the balancing test, respect purpose limitation, and meet transparency and data-minimisation duties — scraping only from reliable sources, timestamping, and validating before training. Special-category data (health, politics, religion, etc.) remains prohibited in principle: incidental collection needs both an Article 6 basis and an Article 9(2) exception, with no general exemption. For any organisation building or fine-tuning on scraped data, this is the operational benchmark a supervisory authority will now measure you against. Open for consultation to 30 October 2026.
Source: European Data Protection Board
Unsure which of these developments applies to your AI systems?
Begin in writing →This briefing is general information, not legal advice, and does not create an advisor–client relationship. Summaries are original; follow source links for the full record. Adesanya AI Advisory — Abdulwahab B. Adesanya, Barrister-at-Law (Nigeria).