A research institute publishes aggregate statistics that are truly anonymous, with no residual identifiers and no reasonable means of re-identification. How does GDPR material scope treat that output?
Select an answer to reveal the explanation.
Short Explanation
Once the fingerprints are genuinely gone and nobody can put names back on the dots, you are looking at anonymous information — not a GDPR personal-data file. Origin stories and file formats do not keep a truly anonymous chart inside the Regulation.
Full Explanation
GDPR material scope covers personal data—information relating to an identified or identifiable natural person. Recital 26 clarifies that the principles of data protection do not apply to anonymous information that does not relate to an identified or identifiable person. Truly anonymous aggregate statistics with no residual identifiers and no reasonable means of re-identification therefore fall outside material scope. Publishing such aggregates can serve civic transparency and research without treating the output as personal data.
Anonymous aggregates do not remain personal data forever merely because they were derived from individuals. Special-category origins do not by themselves keep successfully anonymised outputs inside GDPR. Publication format (PDF vs API) does not decide anonymity.
Exam caveat: weak “anonymisation” that leaves singling-out, linkability, or inference risks is pseudonymisation or still-identifiable data—not anonymity. Re-identification risk must be assessed in light of available means.
Operational check: validate anonymisation with a re-identification threat model, separate anonymous publication pipelines from identifiable microdata stores, and avoid labelling masked-but-reversible fields as anonymous in the RoPA.