SkarpChapter 2 of 16
From Identifiability to Lawful Processing
Whether information is personal data often turns on identifiability, context, and the means reasonably likely to be used. The recitals then connect those threshold questions to consent, pseudonymisation, processing principles, lawful bases, and the compatibility of new purposes.
1. The Path from Data to Lawful Processing
A logical sequence
Recitals (26)-(50) move from who can be identified to whether processing is lawful and then to whether a new use is compatible.
Read modal verbs carefully
These are recitals. A recital's should remains should; do not convert it into a mandatory shall without identifying an operative Article.
Current-status note
As of July 25, 2026, the proposed Digital Omnibus is not in force. This module teaches the GDPR recitals as written.
2. Identifiability, Pseudonymisation, and Anonymous Information
Identifiable means more than named
Recital (26) looks at direct or indirect identification. It says account should be taken of all means reasonably likely to be used, including singling out.
A contextual assessment
Relevant objective factors include identification cost, time, available technology when processing occurs, and technological developments.
Pseudonymised is still personal
If additional information can attribute pseudonymised data to a person, Recital (26) treats it as information on an identifiable natural person.
The anonymous-information boundary
Anonymous information falls outside the stated principles only where it does not relate to an identified or identifiable person, or has been anonymised so the person is no longer identifiable.
Online traces matter
IP addresses, cookie identifiers, RFID tags, and other online identifiers may combine with other information to profile and identify people.
3. Applying the Identification Test and Institutional Context
Worked scenario
A coded university dataset can remain personal data when a separately held key can attribute records to people using means reasonably likely to be used.
Deleting names is not decisive
The question is not simply whether a name was removed. Ask whether identification remains realistically possible in the context.
Deceased persons
Recital (27) says the GDPR does not apply to personal data of deceased persons, while Member States may provide their own processing rules.
Public-authority inquiries
Recital (31) says requests should be written, reasoned, and occasional; they should not cover an entire filing system or interconnect filing systems.
4. Consent: Affirmative, Specific, Informed, and Freely Given
Affirmative conduct
Recital (32) requires a clear affirmative act indicating a freely given, specific, informed, and unambiguous agreement to processing.
What does not count
Silence, pre-ticked boxes, and inactivity should not constitute consent. Consent must be an active signal in context.
Multiple purposes
Consent should cover all processing for the same purpose or purposes. Where processing has multiple purposes, consent should be given for all of them.
Demonstration and information
Recital (42) says the controller should be able to demonstrate consent. At minimum, informed consent requires awareness of the controller and intended purposes.
Freedom and imbalance
A person must have genuine choice and be able to refuse or withdraw without detriment. Recital (43) highlights imbalance and bundled unnecessary consent.
5. Sensitive Contexts: Research, Genetic Data, Health Data, and Children
Research consent
Recital (33) recognises that research purposes may not be fully identifiable at collection. It supports consent to certain research areas within ethical standards.
Genetic data
Genetic data concern inherited or acquired characteristics obtained from biological-sample analysis, including chromosomal, DNA, RNA, or equivalent analysis.
Health data
Health data include information revealing past, current, or future physical or mental health status, regardless of whether it comes from a hospital, doctor, device, or test.
Children
Specific protection should particularly cover child-directed services, marketing, profiling, and collection of children's data. Preventive or counselling services are addressed separately.
6. Fairness, Transparency, Minimisation, Accuracy, Storage, and Security
Lawful, fair, transparent
Recital (39) says processing should be lawful and fair, and people should understand that their data are collected or otherwise processed and to what extent.
Plain language
Information and communication should be easily accessible and easy to understand, with clear and plain language.
Purpose and minimisation
Purposes should be explicit, legitimate, and determined at collection. Data should be adequate, relevant, and limited to what is necessary.
Retention and accuracy
Storage should be limited to a strict minimum. Controllers should set erasure or review limits and take reasonable steps to rectify or delete inaccurate data.
Security and confidentiality
Processing should ensure appropriate security and confidentiality, including prevention of unauthorised access to or use of data and processing equipment.
7. Lawful Processing: Consent Is One Route, Not the Only Route
Several possible bases
Recital (40) places consent alongside other legitimate bases, including legal obligation, contract performance, and pre-contractual steps requested by the data subject.
Legal basis quality
Under Recital (41), a legal basis need not always be a parliamentary act, but it should be clear, precise, and foreseeable.
Contract and law
Recital (44) concerns necessity in a contract context. Recital (45) says legal-obligation, public-interest, and official-authority processing should have a Union or Member State law basis.
Vital interests
Recital (46) addresses processing necessary to protect life-essential interests. Another person's vital interests should in principle be used only where another basis cannot manifestly apply.
8. Legitimate Interests: Relationship, Expectations, and Balancing
The balancing condition
Legitimate interests may provide a basis only where the data subject's interests or fundamental rights and freedoms are not overriding.
Reasonable expectations
Ask whether, at collection and in context, the person could reasonably expect this processing. A client or employment relationship may be relevant, but is not decisive.
Direct marketing
Recital (47) says direct-marketing processing may be regarded as carried out for a legitimate interest. The balancing condition still remains.
Security and administration
Internal group administration and strictly necessary, proportionate network and information security are examples Recitals (48) and (49) associate with legitimate interests.
9. Further Processing: When Can a New Purpose Be Compatible?
Start with compatibility
A new purpose should be compatible with the initial purpose. Where it is compatible, Recital (50) says no separate legal basis from the collection basis is required.
Research, archives, and statistics
Further processing for public-interest archiving, scientific or historical research, or statistical purposes should be considered compatible lawful processing operations.
Compatibility factors
Consider purpose links, collection context and expectations, the data's nature, effects on people, and safeguards in original and intended processing.
Irrespective of compatibility
Consent, or qualifying necessary and proportionate Union or Member State law, can permit further processing irrespective of compatibility, while principles and information should still be ensured.
Secrecy remains important
A legitimate-interest transmission concerning crime or public-security threats should be prohibited if it conflicts with a binding legal, professional, or other secrecy obligation.
10. Quiz: Pseudonymised, Anonymous, or Invalid Consent?
Choose the best answer using the wording and conditions in Recitals (26) and (32).
A retailer replaces customer names with codes but retains a separately stored code key that authorised staff can use to reconnect records to customers. Its website also uses a pre-ticked marketing box. Which answer is best?
- The coded records are anonymous, and the pre-ticked box is valid consent.
- The coded records may concern an identifiable natural person because additional information can attribute them to a person; pre-ticked boxes should not constitute consent.
- The coded records are outside the GDPR whenever the key is stored separately, but consent is valid if customers do not object.
- The coded records are necessarily anonymous because the retailer is the only party with the key.
Show Answer
Answer: B) The coded records may concern an identifiable natural person because additional information can attribute them to a person; pre-ticked boxes should not constitute consent.
Recital (26) treats pseudonymised data as information on an identifiable natural person when additional information can attribute it to that person. Recital (32) expressly says that silence, pre-ticked boxes, or inactivity should not constitute consent.
11. Quiz: Compatibility and Legitimate Interests
Test the limits of Recitals (47) and (50).
Which statement most accurately reflects the recitals on legitimate interests and further processing?
- Direct marketing always overrides the rights and freedoms of the data subject.
- Any new purpose is permitted if the controller originally had a lawful basis.
- Direct marketing may be regarded as carried out for a legitimate interest, but the data subject's interests or fundamental rights and freedoms must not be overriding; compatibility requires a contextual assessment unless Recital (50)'s stated alternatives apply.
- Further processing for statistical purposes is prohibited because its purpose differs from collection.
Show Answer
Answer: C) Direct marketing may be regarded as carried out for a legitimate interest, but the data subject's interests or fundamental rights and freedoms must not be overriding; compatibility requires a contextual assessment unless Recital (50)'s stated alternatives apply.
Recital (47) says direct marketing may be regarded as a legitimate interest, subject to the condition that the individual's interests or fundamental rights and freedoms are not overriding. Recital (50) requires compatibility analysis for new purposes, while stating that public-interest archiving, scientific or historical research, and statistical purposes should be considered compatible lawful processing operations.
12. Flashcards: Core Language from Recitals (26)-(50)
Flip each card and recall the condition, not just the label.
- Identifiable natural person
- Under Recital (26), assess all means reasonably likely to be used for direct or indirect identification, including singling out, costs, time, available technology, and technological developments.
- Pseudonymisation
- Pseudonymised data that can be attributed to a natural person through additional information should be considered information on an identifiable natural person.
- Anonymous information
- Information not relating to an identified or identifiable person, or anonymised so the data subject is not or no longer identifiable; Recital (26) says GDPR principles should not apply to it.
- Consent
- A clear affirmative act establishing a freely given, specific, informed and unambiguous indication of agreement. Silence, pre-ticked boxes, and inactivity should not constitute consent.
- Freely given
- Consent should not be regarded as freely given where the data subject lacks genuine or free choice or cannot refuse or withdraw without detriment.
- Transparency
- Information and communication should be easily accessible and easy to understand, using clear and plain language.
- Data minimisation
- Personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed.
- Legitimate interest
- It may provide a legal basis provided that the data subject's interests or fundamental rights and freedoms are not overriding, considering reasonable expectations.
- Compatible further processing
- Assess links between purposes, collection context and expectations, data nature, consequences, and safeguards. Research, historical research, public-interest archiving, and statistics receive a stated compatibility treatment in Recital (50).
Key Terms
- controller
- The actor referred to throughout these recitals as making or being responsible for decisions and processing activities, including decisions on purposes and means of processing in the discussion of main establishment.
- data subject
- The natural person to whom personal data relate.
- transparency
- The Recital (39) principle that information and communication about processing should be easily accessible, easy to understand, and use clear and plain language.
- identifiability
- Whether a natural person can be identified directly or indirectly using all means reasonably likely to be used.
- pseudonymisation
- A risk-reducing measure that does not necessarily make data anonymous where additional information can attribute the data to a natural person.
- main establishment
- For a controller in the Union, generally the place of central administration, unless another EU establishment takes decisions on purposes and means of processing; the assessment should reflect effective and real management through stable arrangements.
- legitimate interest
- A possible legal basis discussed in Recital (47), subject to a balancing assessment against the data subject's interests or fundamental rights and freedoms.
- anonymous information
- Information that does not relate to an identified or identifiable natural person, or personal data rendered anonymous so the data subject is not or no longer identifiable.
- reasonable expectations
- What a data subject can reasonably expect at collection and in context, based particularly on the relationship with the controller.
- personal data concerning health
- Data revealing past, current, or future physical or mental health status, including the broad examples described in Recital (35).
- secondary or further processing
- Processing for purposes other than those for which personal data were initially collected; Recital (50) focuses on compatibility and stated alternatives.