This post was written by Cynthia O’Donoghue.
In its second opinion on the proposed Data Protection Regulation, the Article 29 Working Party suggests that a natural person can be considered identifiable when, within a group of persons, he or she can be distinguished from other members of the group and consequently be treated differently. They have therefore recommended that information that can lead to individuals being singled out and treated differently should be considered “personal data.” The Working Party proposes broadening the definition of “data subject” in the proposed Regulation to include not only identified or identifiable natural persons, but also those who could be singled out and treated differently.
The Working Party also suggested that organisations should have to treat “cookie identifiers” and “IP addresses” as personal data. This would be accomplished by altering recital 24 which, although not legally binding, provides additional detail on what is to be meant by the definition of personal data.
The Working Party has also defended the "new and positive elements" drafted into the proposed Regulation on rules around consent. Responding to criticism that it might be impractical to always obtain explicit consent, the Working Party supports broad requirements to explicit consent as "necessary to truly enable data subjects to exercise their rights".
The Working Party raised a concern relating to the delegated acts of the European Commission without seeking approval from the Working Party’s successor body, the European Data Protection Board. This concern is shared by the wider data protection community, as the EDPB will be much closer to issues at a national level and be in a position to recommend outcomes.