As an organisation deeply engaged in the development and implementation of GDPR compliance frameworks, we recognise the significant progress made in defining pseudonymisation’s legal and technical dimensions and to ensure effective and harmonized implementation across diverse sectors encourage a co-regulation approach.
Although the EDPB Guidelines and the Code of Conduct share fundamental principles, differences exist in their interpretation, and application. While the Guidelines appear to incorporate several key concepts first developed within the industry-led Code of Conduct, they remain more theoretical and would benefit from other key concepts developed in the Code of Conduct. The Code of Conduct adopts a risk-based and operational approach, ensuring practical feasibility in real-world data processing.
To this end, we respectfully suggest the following key considerations:
- Practical implementation: The Pseudonymisation-CoC provides sector-specific methodologies for applying pseudonymisation, whereas the EDPB remains more general.
- Ensure practical feasibility by aligning regulatory requirements with industry capabilities.
- Allow progressive adaptation by organisations before full enforcement.
- Identify compliance challenges early, ensuring consistent application across Member States.
- Further integrate operational insights and recommendations from the Pseudonymisation-CoC.
Additionally, we encourage the EDPB to consider the pending EDPS v SRB judgment before finalizing the Guidelines, ensuring alignment with evolving case law. To ensure legal clarity, we recommend postponing finalisation and using the Pseudonymisation-CoC’s operational approach as a key reference. We welcome further dialogue to support a practical and future-proof framework.
