Guide
Is blurred video still personal data?
Often, yes. Blurring or masking covers faces and license plates, but what travels with the footage can still point to a person. Whether a dataset is anonymous is decided by an assessment of the whole dataset, not by the filter.
The test
Three questions from WP29 Opinion 05/2014.
Singling out
Can one person be isolated in the dataset, for example through a unique vehicle ID or a GPS track that ends at a home address?
Linkability
Can records about the same person be connected, inside the dataset or with other data?
Inference
Can something about a person be deduced, for example from the place and time of a recurring drive?
What the law says.
The GDPR does not apply to anonymous information (Recital 26): data that no longer relates to an identified or identifiable person, taking into account all means reasonably likely to be used to identify someone.
The Article 29 Working Party (Opinion 05/2014) tests anonymization on three risks: singling out, linkability and inference. Where a dataset does not meet one of them, WP29 calls for a thorough evaluation of the identification risks.
Pseudonymized data remains personal data for whoever can re-identify it. In C-413/23 P (4 September 2025) the CJEU held that pseudonymized data may not be personal data for a recipient who cannot reasonably re-identify the people in it.
For camera data from connected vehicles, the EDPB guidelines 01/2020 recommend processing data locally where possible, and considering anonymization before data is transmitted outside the vehicle.
What to document
Three records make the assessment defensible.
What was masked
Which objects, faces and license plates, were masked in which files.
What stays in the dataset
The metadata, sensor data and identifiers delivered together with the images.
The result
The assessment against the three risks, signed off by your counsel or data protection officer.
Frequently asked questions
Your question is not listed? Ask us directly.
Talk to usIs blurred video anonymous?
Not automatically. Blurring covers direct identifiers, but GPS, timestamps and vehicle IDs can still single out a person; what decides is the assessment under WP29 Opinion 05/2014.
Does the GDPR apply to anonymized camera data?
No, if the dataset is actually anonymous after the assessment (Recital 26). If it stays personal, the GDPR applies in full, including Chapter V for transfers to third countries.
What does Marsstein AEON do?
Marsstein AEON masks faces and license plates in camera data, as a service, inside the EU. Marsstein does not certify that a dataset is anonymous; your counsel or data protection officer signs off.
Sources
Primary sources
Every legal statement on this page rests on one of these documents.
- GDPR Recital 26Anonymous data is outside the GDPR.
- GDPR Chapter V, Articles 44-49Rules for transfers of personal data to third countries.
- Article 29 Working Party, Opinion 05/2014Singling out, linkability and inference as the tests for anonymization.
- EDPB Guidelines 01/2020 on connected vehiclesLocal processing; anonymization before data is transmitted outside the vehicle.
- CJEU C-413/23 P, EDPS v SRB (4 September 2025)Pseudonymized data from the recipient's perspective.
