Deleuze replied: If the data is truly anonymised, then GDPR no longer applies to that anonymised dataset, because the information no longer relates to an identified or identifiable person. GDPR Recital 26 says data protection rules do not apply to anonymous information where the individual is not, or is no longer, identifiable. However, true anonymisation is a high bar, especially for driver images and heart-rate signals. Facial images are inherently identifying unless transformed so that the person cannot reasonably be recognised or re-identified. Heart-rate signals may also be linkable to a person when combined with timestamps, vehicle ID, trip records, device IDs, demographic attributes, or other sensor data. The EDPB states that anonymised data must be rendered anonymous so the individual is not identifiable by any means reasonably likely to be used. There is also a practical conflict: if IRIS needs the data for personalised drowsiness detection, the system usually needs some continuing link to the driver. Once data is fully anonymised, it cannot support driver-specific personalisation, account-level correction, or a meaningful “delete my data” request, because the controller no longer knows which records belong to that driver. So full anonymisation may be suitable for long-term aggregate model improvement, but not for personalised modelling.

Deleuze replied: Pseudonymisation is probably the better approach for personalised drowsiness detection, because it allows the system to retain a protected link between the model data and the driver while still enabling the driver to request deletion. GDPR Article 17 gives individuals the right to erasure where, for example, the data is no longer necessary for the purpose, consent is withdrawn where consent is the lawful basis, or the data has been unlawfully processed. However, the right to erasure is not absolute, so IRIS would need a documented process for deciding when deletion must be honoured and when a lawful retention exception applies. Under the EU AI Act, if IRIS is a high-risk AI system, Article 10 is especially relevant. It permits processing special-category personal data for bias monitoring, detection, and correction only to the extent strictly necessary and subject to safeguards. That means IRIS cannot simply retain sensitive driver data because it is useful. It must show why sensitive data is needed for fairness and safety, why anonymised or synthetic data would not be sufficient, and what safeguards prevent misuse.