Data Without a Name: The EDPB Just Rewrote the Rules on AI Training

Three pages into the European Data Protection Board's draft Guidelines 02/2026 on anonymisation, there is a sentence that will cost someone's legal team six figures to unpick. Not because it is complicated. Because it is precise. The EDPB has finally drawn the line that every AI company building on scraped data has been hoping would never arrive — and it arrived on 7 July 2026, quietly, at a plenary meeting that generated no headlines outside specialist circles. That is exactly how the most consequential legal shifts happen. Not with fanfare. With footnotes.

Here is what the EDPB actually did, and why it matters more than most people working in technology law in Malta and across the EU have yet registered.

Two sets of draft guidelines landed simultaneously. The first addresses anonymisation — specifically, what it means to make personal data genuinely anonymous in the context of generative AI systems. The second addresses web scraping — the practice of extracting data from public-facing websites at scale, which has become the foundational raw material of nearly every large language model trained in the last five years. The Board also adopted final blockchain guidelines at the same session, but those are a different conversation. The AI pair is the weapon.

The anonymisation question is where the real power sits. Under the GDPR, genuinely anonymous data falls outside the regulation entirely. No legal basis required. No data subject rights. No retention limits. The entire edifice of privacy compliance collapses away, and you can process freely. That exemption has been the load-bearing wall of every AI company's privacy architecture for three years. Feed the model on anonymous data, the argument goes, and GDPR never enters the room.

The EDPB has now entered the room. Draft Guidelines 02/2026 make clear that anonymisation in the context of generative AI requires a substantially higher standard of proof than most operators have been applying. The risk is not just whether the data can be re-identified today. The risk is whether a sufficiently capable model — including the very model being trained on the data — could reconstruct individual-level information from aggregate outputs. That is a test almost no current anonymisation framework survives. Legal teams that built compliance programs on the old standard are holding documents that no longer say what they think they say.

The web scraping guidelines hit from a different angle. Public availability, the EDPB is signalling, does not equal consent. Data scraped from a website — even one with no login, no paywall, no explicit terms against scraping — may still constitute personal data processing subject to GDPR if it contains information about identifiable individuals. The lawful basis question does not disappear because the data was technically accessible. It simply moves. Legitimate interests under Article 6(1)(f) remains the most likely home for AI training justifications, but the balancing test the EDPB now expects operators to document is not the cursory exercise that most privacy notices describe. It is a genuine, auditable analysis of competing rights.

For Malta specifically, this matters in a way that extends beyond compliance checklists. Malta-based technology companies, software houses, and AI-adjacent service providers operating under EU law are not insulated from this framework because they are small or because their servers sit in a particular jurisdiction. The GDPR has never cared about jurisdiction the way national law does. It cares about where the data subject is and whether the processing touches EU residents. If your product trains on data that includes EU residents' information — scraped, purchased, licensed, or otherwise acquired — these guidelines are addressed to you personally.

The draft status of the guidelines matters but should not be mistaken for irrelevance. Draft EDPB guidelines are not suggestions. They are the clearest available signal of where enforcement will land when a complaint arrives. Data Protection Authorities across EU member states treat EDPB guidance as the ceiling of defensibility, not a floor to argue upward from. A company that built its AI training pipeline before 7 July 2026 now faces a straightforward choice: audit the pipeline against the new standards while the guidelines are still in draft and corrections are cheap, or wait until they are final and corrections are expensive, public, and documented in an enforcement decision.

There is a negotiation principle I use in every data-related matter I touch. I call it the paper trail pivot. When a regulatory body issues draft guidance, most operators treat it as a period of grace — a window before the rules apply. The smart operators treat it as a window of deniability. You can document, right now,