Source: OJ L 119, 4.5.2016, pp. 1–88 · Consolidated textCurrent language: EN
- General data protection
Basic legislative acts
- GDPR regulation
Article 11 Processing which does not require identification
Summary What does Article 11 of the GDPR regulation say?
This article addresses a practical limitation on controllers: where the purpose of processing does not require identifying the data subject, the controller is not forced to go out of its way to do so simply to comply with the regulation.
It acts as a relief provision, acknowledging that certain processing activities are designed to operate without identifying individuals, and that imposing identification obligations in such cases would be disproportionate.
The article also sets out what happens to data subject rights in these circumstances, connecting directly to Articles 15 to 20, which cover access, rectification, erasure, and related rights.
Important points:
- Controllers are not obliged to maintain, acquire, or process additional information solely to identify a data subject when identification is not required for the processing purpose.
- Where a controller cannot identify the data subject and can demonstrate this, it must inform the data subject of that fact where possible.
- Data subject rights under Articles 15 to 20 are suspended in these cases, unless the data subject provides additional information that enables their identification.
Springlex's summary of the article is a reading aid, not a substitute for the legal text.
If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation.
Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification.
Relevant recitals
Recital 57 No duty to identify unnecessarily
If the personal data processed by a controller do not permit the controller to identify a natural person, the data controller should not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this Regulation. However, the controller should not refuse to take additional information provided by the data subject in order to support the exercise of his or her rights. Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller.
Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.
Definition
processing
Definition
controller
Definition
personal data