1. If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation.
Article 11 GDPR - Processing which does not require identification
2. Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification.
Relevant Recitals
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
Where the purposes of the processing do not or no longer require the identification of a data subject, paragraph 1 relieves the controller of any obligation to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with the Regulation. Compliance with the Regulation is thus not itself a reason to keep or collect identifying information.
No. The data remain personal data and the Regulation continues to apply; Article 11 only removes the duty to hold identifying information and, under paragraph 2, disapplies certain data subject rights. This is consistent with Article 4(5) and Recital 26, under which pseudonymised data that could be attributed to a person by the use of additional information remain personal data.
Under paragraph 2, Articles 15 to 20 do not apply where the controller is able to demonstrate that it is not in a position to identify the data subject. The rights to object under Article 21 and the protections against automated decision-making under Article 22 are not mentioned and therefore remain applicable.
Yes, if possible. Paragraph 2 requires the controller to inform the data subject accordingly where it can demonstrate that it is not in a position to identify him or her, and Article 12(2) adds that the controller may not refuse to act on a rights request unless it makes that demonstration.
Yes. The final clause of paragraph 2 provides that Articles 15 to 20 apply where the data subject, for the purpose of exercising those rights, provides additional information enabling his or her identification, so the disapplication lasts only as long as identification remains impossible.