FEDMA calls for a balanced and future-proof approach to pseudonymization in response to the EDPB’s consultation

Last week, FEDMA submitted its response to the European Data Protection Board’s (EDPB) consultation on the draft Guidelines 01/2025 on pseudonymization. FEDMA welcomes the EDPB’s initiative to provide clarity on pseudonymization techniques, highlighting their critical role in data-driven marketing and responsible data processing. However, we urge the EDPB to ensure a balanced and future-proof approach that fosters both privacy protection and innovation.

Pseudonymization increasingly serves as a key privacy-enhancing technique that enables marketers to leverage data while safeguarding individuals’ privacy. However, pseudonymization techniques remain complex and often resource-intensive, stressing the need for regulatory guidance to support legal certainty, standardized methodologies, and investment in scalable pseudonymization solutions.

In this context, FEDMA highlights concerns regarding the interplay between the EDPB’s draft guidelines and existing legal precedents, particularly the pending Court of Justice of the European Union (CJEU) ruling in the EDPS v. SRB case. The association urges the EDPB to either delay finalizing the guidelines until the CJEU ruling is issued or relaunch a public consultation should the ruling introduce new legal interpretations.

To enhance clarity and effectiveness, FEDMA recommends to:

1. Align the definition of personal data with relevant case law.
2. Provide a workable definition of “additional information” in the context of pseudonymization.
3. Offer clear guidance on assessing re-identification and residual risks.
4. Establish standardized methods for testing pseudonymization robustness.
5. Clarify identity verification procedures following pseudonymization.
6. Explore how pseudonymization can support legitimate interest assessments for data-driven marketing.
7. Expand the use cases in the guidelines beyond health data to include marketing and AI development.
8. Ensure a flexible and contextual application of Article 6(4) GDPR in assessing compatibility of further processing.
9. Recognize pseudonymization as a mitigating factor in regulatory enforcement.
10. Align the guidelines with international standards to enhance global interoperability.

“As data-driven marketing and AI continue to evolve, pseudonymization remains a cornerstone for balancing privacy with innovation,” said Enrico Girotto, Director of Public Affairs at FEDMA. “We urge the EDPB to ensure that the final guidelines provide legal certainty, foster innovation, and align with existing case law and international best practices.”

You can read the full document here.