What Changed
- EDPB adopted draft guidelines on anonymisation, introducing a three-criterion testing framework (no record isolation, no linkage, no inference) and two evaluation approaches.
- EDPB issued guidance on web scraping for generative AI development, addressing GDPR legal bases, data protection principles, and special category data under Article 9.
- EDPB finalized its guidelines on personal data processing through blockchain technologies following a public consultation process.
The European Data Protection Board (EDPB) has adopted new guidelines on anonymisation and web scraping in the context of generative artificial intelligence (AI), alongside the final version of its guidelines on processing personal data through blockchain technologies. These regulatory updates affect data controllers, AI developers, software engineers, and businesses operating within or interacting with the European Union data market.
**Key Clarifications on Anonymisation**
The anonymisation guidelines incorporate recent jurisprudence from the Court of Justice of the European Union (CJEU), including case C-413/23 P (EDPS v SRB, 4 September 2025). Data is defined as anonymous if it does not relate to an identified or identifiable natural person. The EDPB establishes a testing framework using three cumulative criteria: no record isolation, no linkage, and no inference. To determine compliance, controllers may apply either a 'contextual approach' taking into account differing capabilities of potential identifiers, or a 'simplified approach' for greater operational convenience and confidence.
**Web Scraping for Generative AI**
Addressing automated large-scale data extraction for generative AI model training, the guidelines clarify that GDPR rules apply to collection, storage, organisation, and retrieval of scraped personal data. Controllers must comply with purpose limitation, transparency, data minimisation, and accuracy principles, including recording timestamps and validating sources. Where web scraping involves special categories of personal data, controllers require both a lawful basis under Article 6 GDPR and an exception under Article 9(2) GDPR. Citing CJEU ruling GC & Others (C-136/17), the EDPB highlights that incidental collection of special category data requires case-by-case assessment and technical safeguard implementation.
**Blockchain Guidelines Finalised**
Following a public consultation, the EDPB finalised its guidelines explaining blockchain architectures and their implications for GDPR compliance. A report on the consultation feedback and a track-changes version have also been released.
Both the anonymisation and web scraping guidelines remain open for public consultation until 30 October 2026.
Who May Be Affected
AI developers, data controllers, web scrapers, blockchain technology operators, and organisations processing EU personal data.
Cross-Border Context
Applies to any entities worldwide that scrape data, develop generative AI models, or operate blockchain systems involving the processing of personal data subject to the EU GDPR.
What to check next
- Monitor EDPB public consultation submissions open until 30 October 2026 for anonymisation and web scraping guidelines.
- Review full text of CJEU rulings C-413/23 P (EDPS v SRB) and C-136/17 (GC & Others) referenced in the guidance.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.
Prepared automatically with AI assistance from the official sources linked on this page. Translations and explanations do not replace the official text.