-

Full anonymization removes GDPR obligations but may limit model improvement. Pseudonymization is usually sufficient if combined with strong access controls and a right-to-erasure mechanism, allowing users to delete their data. Retaining identifiable data after profile deletion would raise legal risks.

Full anonymization → safest, fewer legal limits • Pseudonymization → allowed if “right to be forgotten” and strong securi

Should be deleted once 5 years has passed

Only data necessary for fatigue detection should be collected and stored for limited periods. Users must understand why their data is processed. Regular checks ensure the data is not reused beyond its purpose.

Pseudo-anonymization with deletion on request is generally sufficient under GDPR, but full anonymization reduces legal risk; retaining data after deletion could still have legal implications.

The data must be saved up to 10 years according to the EU AI charter for various reasons including the database

If you fully anonymize data, it is no longer considered "personal data," and GDPR no longer applies. You could legally retain this data for 5 years (or indefinitely) even after a profile is deleted.

Yes

From both a legal and ethical standpoint, full anonymization is preferable but not always technically feasible for biometric datasets. Full anonymization removes all identifiable links to individuals and places data outside GDPR’s scope. This allows longer retention (e.g. 5 years) but is extremely difficult to achieve with facial or physiological data without destroying its utility. Pseudonymization retains identifiers separately and allows compliance with GDPR rights, including the right to erasure (“right to be forgotten”). In practice, pseudonymization combined with strict access controls, encryption, and deletion mechanisms is generally considered sufficient and more realistic, provided users can request deletion and data is not retained longer than necessary. Ethically, respecting user control and deletion rights is critical to maintaining trust, even if anonymization would offer fewer legal constraints.

Full anonymisation is not strictly required though it provides protection

It is not required but it provides protection

Shii idk

Pseudo-anonymization with a functional “right to be forgotten” is generally sufficient if personal identifiers can be deleted on request. Full anonymization is stricter, allows longer retention without legal risk, but may limit personalized model improvements. Key: Must prevent re-identification and comply with GDPR retention limits.

I believe full anonymisation would allow use without legal implication, provided thr users agreed to the data collection.

Let full anonymization be required

I suppose psuedo-anonymisation can be used.