The ICO has recently published some draft guidance titled ‘Introduction to anonymisation’. Whilst the guidance is currently only a draft and is likely to be subject to some refinement, it still offers a helpful insight into both anonymisation and pseudonymisation in the context of data protection.
What is anonymisation?
When looking at what is meant by anonymisation, it is first helpful to look at the definition of anonymous information.
Recital 26 of UK GDPR offers some guidance as to the term ‘anonymous information’ which states it is:
“…information which does not relate to an identified or identifiable natural person or to personal data rendered in such a manner that the data subject is not or no longer identifiable.”
Once the information has been anonymised correctly the data is no longer personal data, meaning the principles of data protection do not apply nor do they need to be followed when the data is processed.
So what is anonymisation? Anonymisation is the way in which personal data is turned into anonymous information so that it falls outside of the scope of data protection legislation.
Data is sufficiently anonymised when it no longer relates to an identified or identifiable individual or is rendered anonymous so that the individuals are not/no longer identifiable.
What is pseudonymisation?
The guidance makes it clear that pseudonymisation is a technique that replaces or removes information that identifies an individual, such as replacing a name or other identifier with a reference number.
Article 4(5) of the UK GDPR confirms that pseudonymisation is:
“the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information…”
The additional information referred to within Article 4(5) must of course be kept separately with the relevant controls in place to ensure that it is not possible to re-identify the individual.
Whilst anonymisation and pseudonymisation do have some similarities in very simple terms:
- Anonymisation means that individuals are not identifiable and cannot be re-identified by any means; and
- Pseudonymisation means that individuals are not identifiable from the data itself but can be identified by referring to other information held separately.
How can Nelsons help?
Ruby Ashby is an Associate in our expert Dispute Resolution team.
If you have any questions concerning the subjects discussed in this article, please do not hesitate to contact Ruby or another member of the team in Derby, Leicester or Nottingham on 0800 024 1976 or via our online enquiry form.