Privacy-enhancing Technologies for Active and Assisted Living: What Does the GDPR Say?

Privacy-enhancing technologies (PETs) promise to safeguard privacy and security alongside the use of active and assisted living (AAL) tools. To what extent PETs meet the expectations of EU data protection norms however needs to be better understood. This paper aims to determine whether PETs used for AAL purposes are anonymisation or pseudonymisation methods under the General Data Protection Regulation (GDPR). In this paper, doctrinal legal research is used as the main research method. This means that primary legal sources such as EU laws will be relied upon and analysed in the context of PETs for AAL purposes. Specifically, this paper first conducted an inquiry into several important EU data protection concepts, namely anonymisation, pseudonymisation and data protection by design. On this basis, focus was shifted to state-of-the-art PETs for AAL, which are then used as examples to measure against these data protection concepts. A closer look at PETs in the AAL context finds that most groups of PETs for AAL are more likely to be considered as pseudonymisation methods rather than anonymisation methods because of their technical reversibility. This general assessment is however subject to change in each specific case since the notion of anonymisation under the GDPR is not absolute, but contextual specific and sensitive to factors such as costs, time, and available technologies for re-identification. Based on the findings, clearer guidance seems necessary in order to determine what constitutes anonymisation under the EU data protection regime such that legal certainty could be increased.