As far as I understand data can only become anonymous as soon as the part that can lead to reidentification is actually deleted. We have such a case with the re

As far as I understand data can only become anonymous as soon as the part that can lead to reidentification is actually deleted. We have such a case with the release of an 'anonymized' dataset , where the original data or the reidentifying set still exists. As far as I heard the opinions of the DPOs involved, the original data needs to get deleted for the data to be actually anonymous (although the data in the wild will not change). The problem is that otherwise th GDPR would have no effect anymore and the controller could 'anonymize' sensitive information and only keep uncritical identifying information. The other question on what basis of article 6 such processing would be allowed, as also the anonymization proceedure would probably count as processing. However, I have also heard theopinion of DPOs that you do not have to care as a receiver/user about the effectiveness of the anonymization, while other experts clearly state that there is a risk of becoming a controler if you cannot trace the effectiveness of anonymization and even the legal basis for that back to the origin.