Personal data, non-personal data, anonymised data, pseudonymised data, de-identified data

The primary scope of application of the General Data Protection Regulation - Regulation (UE) 2016/679 (GDPR) - is ‘personal data’; ‘data’ that is not personal data can be freely processed within the legal framework of the Regulation (UE) 2018/1807. Although the European data protection framework recognizes these two categories of data – ‘personal data’ and ‘non-personal data’ - reality reveals “a lot in between” the opposite endpoints. There are accordingly considerable complications in drawing the boundaries between personal and non-personal data. In this article we will review some of the main issues related to the usual classification of data as personal, anonymous, pseudonymous, de-identified data, and suggest that the most realistic way to approach the different problems is to recognize the dynamic nature of the data