Regulation (EU) 2016/679 (GDPR) · Chapter II · Principles
Art. 11 · Processing which does not require identification
Text
-
If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation.
-
Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification.
Rights of the data subject
Section 1
Transparency and modalities
Text: EUR-Lex, CELEX 32016R0679 (consolidated text with corrigenda).
Commentary
A controller need not acquire additional identifying data just to comply with the Regulation. If it cannot identify the data subject, the rights under Art. 15 to 20 do not apply, unless the data subject supplies the identification themselves.