The EHDS prescribes a comprehensive and uniform assessment by the HDAB. A separate ethical assessment adds nothing and hinders science.
Does the draft Digital Omnibus (GDPR) abolish the Scania ruling? No.
Omnibus is being criticized
In various publications, the position is defended that the draft Digital Omnibus (concerning, among other things, amendments to the GDPR) would nullify the legal effect of the Scania judgment (C-319/22): in iBestuur among others, and on LinkedIn. However, a close reading of the text suggests otherwise. The Commission is not striking down Scania, but rather defining its scope.
Indirect personal data
In the Scania judgment, the EU Court ruled that if data (such as chassis numbers) constitute personal data for the recipient, they indirectly also constitute personal data for the provider. The fear of undermining this judgment is based on the addition proposed by the Commission to Article 4(1) of the GDPR: “Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.”
What is the difference
In my view, the crux of the correct interpretation of this sentence lies in the word ‘potential.’ A distinction must be made between an actual and a potential data transfer:
– The Scania doctrine (Actual transfer): In the Scania judgment, there was an actual provision of data to independent market participants. Because the data were actually transferred to a party with means of identification, the status of personal data indirectly extended to the original provider.
– The Omnibus text (Potential transfer): The proposed legislative text addresses exclusively the potential subsequent recipient. This provision aims to prevent internally processed, pseudonymized data from qualifying as personal data merely on the basis of the theoretical fact that there is a party somewhere in the world that could decrypt it.
A demarcation
Conclusion: With the draft Digital Omnibus, the European Commission does not annul the Scania judgment, but codifies the logical limits of the relative concept of personal data, as previously confirmed in the SRB case: if you actually transfer data to a party with identification capacity, the data also qualify as personal data for you. If it remains a hypothetical, potential recipient, this classification does not apply. The proposed addition thus offers, as the Commission itself states, a clarification of current case law, without undermining the Court’s fundamental principle of protection.
How does the EU define 'scientific research' in the Digital Omnibus? There has been criticism of this, but it is unjustified.
Many people are afraid that their jobs are at risk due to AI. I decided to turn the question around and asked Gemini: which jobs are you going to take over, in a way that make us happy? Here is her own optimistic answer.