Identification

Legal Framework

Identification sits at the heart of the GDPR's scope. Article 4(1) defines personal data by reference to an identified or identifiable natural person, and the concept of identifiability—direct or indirect, through names, identification numbers, online identifiers, or other factors—determines whether the Regulation applies at all. Article 11 addresses the converse situation: where a controller's purposes do not require identification, the controller need not acquire additional information solely to comply with the GDPR. If the controller demonstrates it cannot identify the data subject, it must so inform the data subject, and Articles 15–20 do not apply unless the data subject provides additional information enabling identification.

"Member States may further determine the specific conditions for the processing of a national identification number or any other identifier of general application."
— GDPR Art. 87

Article 87 permits Member States to set specific conditions for national identification numbers, subject to appropriate safeguards. The AI Act's Recital 17 introduces a functional definition of remote biometric identification systems, distinguishing identification (1-to-many) from authentication (1-to-1 verification), with the latter excluded from the remote biometric identification framework due to its comparatively minor rights impact.

Key Developments

The CJEU has consistently applied a broad reading of identifiability. In Deutsche Post AG v Hauptzollamt Köln, the Court reiterated the full Article 4(1) definition, confirming that indirect identification through any identifier suffices to bring data within the GDPR's scope. The same formulation appears in Hauptpersonalrat der Lehrerinnen und Lehrer and Nacionalinis visuomenės sveikatos centras, underscoring that identifiability does not require a name—any factor specific to the person's identity can suffice.

Biometric identification has emerged as a particularly contested area. The Dutch Supreme Court in Hoge Raad, 12-06-2026 addressed whether storing a photograph constitutes processing of biometric data under Article 9(1) in connection with Article 4(14). The EDPB's Guidelines 3/2019 clarify that raw video footage is not biometric data unless specifically technically processed for identification purposes:

"The video footage of an individual cannot however in itself be considered as biometric data under Article 9, if it has not been specifically technically processed in order to contribute to the identification of an individual."
— EDPB Guidelines 3/2019 §37

Enforcement reflects this distinction. The Swedish DPA in Storstockholms Lokaltrafik found that audio recordings did not contribute to identifying fare evaders, violating data minimisation under Article 5(1)(c). The EDPB's Opinion 11/2024 further separates authentication from identification, confirming both involve special-category biometric data but serve functionally distinct purposes.

Status of the Debate

This topic is actively contested in court. The boundaries of what constitutes identification—particularly through biometric processing—remain in flux. The divergence between Schrems v Meta Platforms Ireland and European Commission v Republic of Poland illustrates the tension:

"at the invitation of the Representation of the European Commission in Austria, Mr Schrems referred to his sexual orientation for the purpose of criticising Facebook's processing of personal data, including the processing of his own data."
— Schrems v Meta Platforms Ireland

The core dispute concerns whether publicly disclosed attributes can later serve as identifiers for processing purposes, and whether controllers who theoretically could identify individuals through combination of datasets must be treated as doing so. Courts have not uniformly resolved whether pseudonymised data remains personal data when the controller holds the key separately, though the prevailing doctrinal view treats it as personal data given the possibility of re-identification.

Practical Guidance

• Assess identifiability contextually: Determine whether a person can be directly or indirectly identified using all means reasonably likely to be used. If identification is not required for your purposes, document this under Article 11 and avoid acquiring additional identifying data.
• Distinguish authentication from identification: 1-to-1 biometric verification for service access falls outside the AI Act's remote biometric identification rules, but still constitutes Article 9 special-category processing requiring an Article 9(2) exemption and an Article 6(1) legal basis.
• Apply data minimisation to identification methods: The Storstockholms Lokatrafik decision demonstrates that collecting more data than necessary for identification—such as audio where images suffice—violates Article 5(1)(c).
• Check Member State rules on national identifiers: Article 87 allows Member States to impose additional conditions on national identification numbers; verify local implementation before relying on such identifiers.
• Document technical processing boundaries: Raw photographs or video footage are not biometric data under Article 9 unless technically processed for unique identification. Maintain records showing the purpose and method of any biometric processing to demonstrate compliance with the three-criteria test from EDPB Guidelines 3/2019.