It's all 'relative': Genomic data and the EDPB's draft anonymization guidelines

The European Data Protection Board's draft "Guidelines 02/2026 on Anonymisation" reflect a recipient-specific approach: the same data may be anonymous for one organization but personal data for another, depending on the means each is reasonably likely to use. 

Genomic data, which the EU General Data Protection Regulation treats as genetic data under Article 4(13) and as a special category under Article 9, tests that approach, because a patient may be identifiable through a relative's genetic information that neither the disclosing controller nor the recipient holds. 

Consider a scenario the draft guidelines do not yet address. A hospital wants to share whole-genome sequences with a research institute for a rare-disease project. It removes names, birthdates and other identifiers. The institute receives no key, has no access to the hospital's records and decides for itself how to process the data. Are the sequences anonymous for the institute?

The answer has significant legal consequences for both parties. For the research institute, the answer determines whether the GDPR applies to its processing and, if so, whether obligations such as identifying a legal basis and notifying a breach arise. The answer also affects what the hospital can warrant in the data-sharing agreement, whether the dataset may be deposited in an open or controlled-access repository and, under the European Health Data Space, whether a health data access body may release the data in anonymized form or only in pseudonymized form under stricter conditions. For the hospital, which retains the key, the sequences remain personal data regardless.