Statistics

Legal Framework

Statistical processing occupies a privileged position under the GDPR, but that privilege is conditional. Article 5(1)(b) provides that further processing for statistical purposes "shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes," while Article 5(1)(e) permits longer storage periods for the same reason. Both exemptions hinge on compliance with Article 89(1), which requires appropriate safeguards for the rights and freedoms of data subjects — including data minimisation, pseudonymisation, and technical and organisational measures.

Where special categories of personal data are involved, Article 9(2)(j) lifts the general prohibition on processing for statistical purposes, subject to Union or Member State law providing appropriate safeguards. Transparency obligations are also relaxed: under Article 14(5)(b), the right to be informed does not apply where processing for statistical purposes makes provision of that information impossible or would involve disproportionate effort. The right to erasure is similarly limited — Article 17(3)(d) exempts processing for statistical purposes under Article 89(1) where erasure would render impossible or seriously impair the achievement of those objectives.

Key Developments

The CJEU's ruling in Wirtschaftsakademie Schleswig-Holstein established a critical principle for statistical processing: controllership is not negated by the fact that statistical output is anonymised. The Court held:

"While the audience statistics compiled by Facebook are indeed transmitted to the fan page administrator only in anonymised form, it remains the case that the production of those statistics is based on the prior collection, by means of cookies installed by Facebook on the computers or other devices of visitors to that page"
— Wirtschaftsakademie ¶38

This means that the collection and processing stages — not the final statistical output — determine responsibility and applicable obligations. Joint controllership can arise even where one operator never accesses identifiable data.

The earlier Rynes decision addressed the information exemption for statistical processing under Directive 95/46, the predecessor to Article 14(5)(b) GDPR. The Court confirmed that the exemption from providing information to data subjects applies specifically "for processing for statistical purposes or for the purposes of historical or scientific research" where provision of information proves impossible or disproportionate — a standard carried forward into the GDPR.

The EDPB has reinforced that anonymisation is the preferred endpoint:

"Anonymisation is the preferred solution as soon as the purpose of the research can be achieved without the processing of personal data."
— EDPB Guidelines 05/2020 §160

Status of the Debate

This topic is actively contested in court. The boundaries of statistical processing — particularly what qualifies as a genuine statistical purpose versus a commercial analytics function — remain unsettled. Courts have diverged on whether web analytics and audience measurement constitute statistical processing under Article 89(1) or fall under general processing subject to full GDPR obligations. The Wirtschaftsakademie ruling narrowed the scope for avoiding controllership through anonymisation of outputs, but did not fully define the threshold for qualifying statistical purpose. What would resolve the open question is a CJEU reference addressing whether purely commercial statistical processing benefits from the Article 5(1)(b) and 17(3)(d) exemptions, or whether those provisions are reserved for public-interest or research-oriented statistics.

Practical Guidance

• Anchor statistical processing in Article 89(1) safeguards. Implement data minimisation, pseudonymisation, and access controls from the outset. Document these measures — they are the legal condition for the purpose-limitation and storage-limitation exemptions under Article 5(1)(b) and (e).

• Plan for anonymisation as the terminal step. Where statistical results can be achieved with anonymised data, the EDPB considers this the preferred solution. This eliminates further GDPR exposure but does not retroactively remove obligations from the collection and processing stages.

• Do not assume anonymised output shields you from controllership. Under Wirtschaftsakademie, the prior collection of personal data for statistical purposes triggers full responsibility, even if the final statistics are anonymised.

• Assess erasure exemptions carefully. Article 17(3)(d) exempts statistical processing from the right to erasure only where erasure would "render impossible or seriously impair" the statistical objectives. This is a high threshold — document the impairment analysis.

• Verify Member State law for special-category data. Article 9(2)(j) requires a basis in Union or Member State law with appropriate safeguards before processing health, biometric, or other special-category data for statistics.