Anonymization and Identifiability

The author explores the nature of data anonymization under the GDPR, with a particular focus on means of differential privacy. First, he examines the requirement of "identified or identifiable" in Art. 4 GDPR. Building on this foundation, he describes and evaluates different methods for the anonymization of structured and unstructured data, especially text data. The author describes the role of machine learning and artificial intelligence with regard to anonymizing unstructured data and elaborates on the data protection implications of training and using AI/ML models (including federated learning setups) for this purpose.