Restoring Legal Certainty in EU Data Protection Law

Position statement

Contextual identifiability belongs in binding law.

The report argues that Article 4 GDPR now functions as a switching rule across the wider digital acquis. A credible settlement should combine actor-relative identifiability with anti-circumvention rules, documented assurance, clear consequences and disciplined supervisory governance.

Download the full report Watch the lecture series

Position at a glance

Six connected reforms.

The report treats scope, substantive rules and institutions as one system rather than independent amendment boxes.

01

Article 4

Codify actor-relative identifiability and realistic downstream responsibility.

02

Article 9

Stop inference and incidental sensitivity from becoming an internal super-trigger.

03

ePrivacy

Replace repetitive consent with a tightly bounded low-risk whitelist and reusable choices.

04

AI pathways

Create safeguarded routes for training and residual special-category data.

05

Institutions

Bind the EDPB and EDPS to cooperation, evidence and reasoned method.

06

Innovation

Apply a bounded Innovation Mandate within the lawful choice set.

Strong data protection does not require the GDPR to attach to every data artefact for every actor whenever identification remains imaginable somewhere.

DigiData Policy Report, conclusion

The report’s organising claim

The Digital Omnibus offers the only immediate legislative route for stabilising the trigger conditions of EU data protection law. The report reads the Court’s judgment in EDPS v SRB together with EDPB Guidelines 02/2026 and argues that the dispute has shifted from whether contextuality exists to how law should bound, evidence and safeguard it.

Why Article 4 reaches beyond the GDPR

Classification determines whether the AI Act, Data Act, European Health Data Space, common data spaces and research infrastructures operate independently or beneath a cumulative GDPR overlay. An unstable threshold recreates the same cost across each regime.

Assurance rather than slogans

The report proposes a statutory route that records the actor, purpose, access mode, circulation boundary, technical and organisational controls, realistic auxiliary information, testing, expiry and reassessment. Compliance with approved methods or certification should create a rebuttable presumption, not immunity.

Institutional settlement

The legislature should set the perimeter. The EDPB should maintain methods, attack models, examples and assurance. Authorities should enforce within that framework, and major supervisory choices should disclose evidence, alternatives and proportionality reasoning.