The European Union's top data protection authority adopted new rules Wednesday, with the European Data Protection Board's Guidelines 02/2026 on Anonymisation replacing the previous working definition with a three-test standard. The guidelines, published July 8, require data to resist individual isolation, linkage, and inference; all three criteria must be satisfied simultaneously, or the data remains personal data under GDPR. The new rules respond to documented instances of AI defeating anonymization, including a 2025 demonstration that GPT-4 can infer personal attributes from social media posts with roughly 85 percent Top-1 accuracy, a January 2026 paper showing off-the-shelf agentic LLMs could link six of 24 interviews in an anonymized dataset to specific individuals, and Tübingen researchers in June 2025 establishing that large language models memorize between 0.1 and 10 percent of their training data verbatim. The consultation window closes October 30.