The Shredder Problem: Why Europe's Pseudonymisation Gambit Collides With Washington's Data Perimeter
Brussels wants to reclassify pseudonymised data to unlock AI training. Washington is simultaneously fencing the same data categories behind national-security controls. Both cannot be right about what "identifiable" means.
In 2011, the Pentagon's research arm ran a competition. DARPA shredded five documents, published the scans, and offered $50,000 to whoever could put them back together. A three-person team from San Diego recovered all five in 33 days using computer vision and a custom solver. The lesson was not that shredders are useless. It was that destroyed is a claim about the adversary's budget, not a property of the paper. Fifteen years later, European policymakers are proposing to write that distinction out of law.
The development: The European Commission's Digital Omnibus package, tabled in November 2025, would narrow the definition of personal data by codifying a relative approach to pseudonymisation — treating data as non-personal in the hands of recipients who lack realistic means of re-identification — while recognising legitimate interest as a lawful basis for AI training. In parallel, the US Justice Department's bulk sensitive data rule (28 CFR Part 202) has imposed hard transfer restrictions on precisely those categories: genomic, biometric, geolocation and health records. One regime is loosening the perimeter on identifiability grounds; the other is tightening it on national-security grounds, using the same data.
Identifiability Is a Compute Budget, Not a Legal Status
The Commission's proposal is not legally baseless. It draws on the General Court's reasoning in SRB v EDPS (T-557/20), which held that pseudonymised comments passed to a recipient with no re-identification key were not personal data for that recipient. The doctrine is coherent. The engineering is not.
The primary literature is unambiguous about how thin the protection is. In a 2019 Nature Communications paper, Rocher, Hendrickx and de Montjoye estimated that 99.98% of Americans could be correctly re-identified in any dataset using just 15 demographic attributes — and that a mere 1% of the population would be uniquely identifiable from three attributes in a heavily sampled dataset. Fifteen attributes is fewer fields than a standard e-commerce checkout captures. The proposed legal test asks whether a recipient possesses "means reasonably likely to be used." That test was drafted when re-identification required a motivated academic with a cluster. It now requires a foundation model, a scraped auxiliary corpus, and an afternoon.
The implication mainstream coverage has missed: the amendment does not reduce risk, it relocates liability. Once data crosses the pseudonymisation threshold, the controller's Chapter II obligations, data-subject rights, and Article 33 breach clock arguably stop. The re-identification risk does not stop. It becomes an uninsured externality sitting with the data subject.
The Netflix Prize Already Ran This Experiment
We have a controlled precedent. In 2006, Netflix released 100 million "anonymised" film ratings for a $1 million recommendation-algorithm prize. In 2008, Arvind Narayanan and Vitaly Shmatikov published Robust De-anonymization of Large Sparse Datasets at the IEEE Symposium on Security and Privacy, cross-referencing the corpus against public IMDb reviews. They identified individual subscribers and, with them, inferred viewing histories that carried political and sexual-orientation signal. A class action followed; the sequel prize was cancelled.
Netflix had done everything the compliance playbook demanded. It removed names, perturbed ratings, and limited the released fields. The failure was structural: high-dimensional sparse data carries its own fingerprint. The lesson is not that anonymisation is impossible — differential privacy provides formal guarantees — but that ad hoc de-identification fails predictably against linkage attacks, and that the failure surfaces years after release. Europe is proposing to make that failure mode a jurisdictional carve-out.
Counter-Argument: The Purists Are Overstating the Threat Model
The opposing case deserves a fair hearing. Re-identification studies model a motivated adversary with access to a matching auxiliary dataset. Most commercial recipients of pseudonymised data have neither the incentive nor the linkage corpus. Treating a Belgian logistics SME the same as a state intelligence service imposes costs without buying protection.
There is also a research cost that privacy advocates routinely discount. Clinical and epidemiological work depends on linking records across institutions; a strict absolute-identifiability standard has blocked legitimate studies for a decade. And the technical alternative already exists: differential privacy, synthetic data generation and secure enclaves offer measurable guarantees that a binary legal classification never did. On this reading, the Omnibus is not deregulation but a belated acknowledgment that the 2016 binary — personal or not — was always a poor proxy for risk, and that a recipient-relative test is closer to the underlying reality.
Minimisation Arbitrage and the Consent Fatigue Dividend
The second-order effect is a compliance arbitrage that will reshape data architecture faster than any enforcement action. The Omnibus also proposes folding cookie-consent rules into the GDPR and consolidating breach reporting into a single portal. Layer that against Maryland's Online Data Privacy Act, in force since October 2025, which imposes a genuine data-minimisation duty — collection limited to what is reasonably necessary for the specific product the consumer requested, with heightened restrictions on sensitive data and a near-prohibition on selling it.
Multinationals now face two incompatible optimisation targets. The EU is reducing consent friction; Maryland is reducing permissible collection volume. The rational response is not two stacks but one: collect less, retain less, and process on-device. Firms that have already invested in edge inference and federated aggregation will find their architecture is suddenly the cheapest compliance posture on both sides of the Atlantic. Firms running consent-banner-driven acquisition funnels will discover their entire measurement layer was a regulatory artefact.
The Transfer Rule Nobody Costed
While Brussels debates definitions, the DOJ rule has already changed where data may physically sit. It restricts bulk transfers of covered sensitive categories to countries of concern, with thresholds set low enough to catch ordinary commercial telemetry — the genomic threshold sits at 100 US persons. Vendor agreements, cloud regions and support-access models all fall in scope.
The enforcement precedent is not hypothetical. The Irish Data Protection Commission's May 2023 decision against Meta Platforms Ireland imposed a €1.2 billion administrative fine — the largest in GDPR history — over Chapter V transfers, alongside an order to suspend them. That was a transfers case, not a breach case. No one's data was stolen. The violation was architectural. Organisations that reclassify pseudonymised datasets out of GDPR scope while those same datasets sit in a foreign-accessible support pipeline will have solved a European paperwork problem and created an American criminal-referral problem simultaneously.
Counter-Argument: Simplification Has a Real Constituency
It is too easy to read every Omnibus provision as capture. The Draghi competitiveness analysis identified regulatory fragmentation as a material drag on European technology formation, and the compliance asymmetry is measurable: a fixed-cost regulatory burden falls disproportionately on firms without legal departments. A ten-person Lisbon startup and a trillion-dollar platform face the same Article 30 record-keeping obligation.
Consent consolidation, in particular, addresses a genuine failure. Banner fatigue has produced a population that clicks through everything, which is not autonomy — it is theatre. A single, enforceable signal is plausibly more protective than 400 interruptions. The defensible critique of the Omnibus is therefore narrow and specific: the procedural simplifications are sound, and the substantive redefinition of identifiability is not. Collapsing the two into a single objection weakens the case against the part that matters.
What To Do Before The Text Settles
- Run a linkage test, not a classification review. Take your pseudonymised datasets and attempt re-identification against a commercially available auxiliary corpus. Document the result. If you cannot demonstrate resistance, you cannot defend a "no reasonably likely means" position to a regulator or a plaintiff.
- Map support access, not just storage location. DOJ exposure turns on who can reach the data, including offshore support contractors and vendor administrators. Region-pinning a database does not resolve a foreign-accessible IAM path.
- Instrument minimisation now. Field-level collection inventories pay off under Maryland-style duties regardless of the Omnibus outcome. This is the rare investment that is correct under both regulatory futures.
- Small businesses: do not build on the carve-out. Reclassifying data as non-personal on the strength of a proposal still in trilogue is a bet against the eventual text. Wait for the adopted version.
- Individuals: deletion and access requests remain the only rights with direct effect. Exercise them against data brokers specifically — aggregated broker profiles are the auxiliary corpus that makes every linkage attack in this article work.
Six Months Out: Divergence, Then Litigation
Expect the identifiability provision to become the contested core of trilogue, with the Parliament's civil-liberties bloc and the EDPS pushing back against the Council's competitiveness framing. A watered-down relative test with an explicit re-identification-risk assessment obligation is the most probable landing zone.
Regardless of the text, three things follow. Differential privacy adoption moves from research teams into production procurement as the only defensible way to claim non-identifiability. Specialist re-identification testing emerges as an auditable service line, priced like penetration testing. And the first enforcement action under a recipient-relative regime will turn not on whether data was pseudonymised, but on whether the recipient's linkage capability was honestly assessed — the same question the DARPA entrants answered in 2011, now with a legal remedy attached. The strips are still recoverable. The only variable is who bothers.