84,211
edits
Pseudonymised data: Difference between revisions
Jump to navigation
Jump to search
no edit summary
Amwelladmin (talk | contribs) m (Amwelladmin moved page Pseudonymised information to Pseudonymised data) |
Amwelladmin (talk | contribs) No edit summary |
||
| Line 13: | Line 13: | ||
*If you anonymise data — switch out all references to someone identifiable IRL with unique identifiers, randomised numbers and so on so that there is no possibility of anyone — whether inside your organisation of outside it — reverse engineering who the individuals are, then you are ''not'' processing personal data. | *If you anonymise data — switch out all references to someone identifiable IRL with unique identifiers, randomised numbers and so on so that there is no possibility of anyone — whether inside your organisation of outside it — reverse engineering who the individuals are, then you are ''not'' processing personal data. | ||
*If you ''pseudonymise'' data — which is to anonymise it as per above but separately hold some kind of key which decodes it into something identifiable, then it still counts as personal data. If you are a third party given pseudonymised data, even though in your hands it is anonymous, seeing as someone else could reverse engineer it, it is still, in your hands, pseudonymised. This seems a bit harsh, but the risk is you (and the person holding the “key”) suffer some data breach or something like that. | *If you ''pseudonymise'' data — which is to anonymise it as per above but separately hold some kind of key which decodes it into something identifiable, then it still counts as personal data. If you are a third party given pseudonymised data, even though in your hands it is anonymous, seeing as someone else could reverse engineer it, it is still, in your hands, pseudonymised. This seems a bit harsh, but the risk is you (and the person holding the “key”) suffer some data breach or something like that. | ||
===Or does it=== | |||
If you wanted to make the alternative claim, you might look to thethe ruling of General Court of the European Union Case T-557/20, ''SRB v EDPS'', in which the General Court found that pseudonymised data will not be considered personal data in the hands of a recipient who does not have the additional decoding information needed to re-identify the data subjects and no legal means of obtaining it. The court thought the fact that the ''sender'' has the decoding key, and the means to re-identify data subjects, was irrelevant. | |||
{{sa}} | {{sa}} | ||
*[[Personal data]] | *[[Personal data]] | ||
*{{plainlink|https://ico.org.uk/media/about-the-ico/consultations/4019579/chapter-3-anonymisation-guidance.pdf|ICO guidance}} | *{{plainlink|https://ico.org.uk/media/about-the-ico/consultations/4019579/chapter-3-anonymisation-guidance.pdf|ICO guidance}} | ||