Anonymising personal data under the data legislative acquis established by the Data Governance Act

The re-identification risk test, established under Recital 26 of the General Data Protection Regulation (GDPR), constitutes a milestone in assessing the efficiency of personal data anonymisation. Its interpretation and implementation have been largely discussed by scholars and practitioners. This article illustrates the challenges to the plausibility of the anonymisation risk test, especially considering the most recent European jurisprudence on data anonymisation, and the recent Digital Omnibus proposal. Although this regulatory proposal aims at repealing the Data Governance Act, it transposes its data governance model into the Data Act. With the aim to foster the regulatory and scholar debate of this new proposal, our work puts forward a new perspective on data anonymisation within the frame the DGA, considering its potential to reduce legal uncertainty to the application of anonymisation through data intermediaries. Specifically, our work investigates how Data Intermediation Service Provider (DISP) could support data holders in anonymising data, impacting on accountability when providing access to data and sharing of data. Although the involvement of DISPs may raise additional questions in terms of the responsibilities of a DISP, this article outlines the pertinent rules established by the DGA to analyse and discuss such potential responsibilities and to elaborate on their possible contractual consequences with respect to data anonymisation.