Pseudonymization and anonymization

October 13, 2021

Categories:

Data protection

Why is it often better to talk about C3PO instead of Max Meier in the sales statistics?

Introduction to Anonymization and Pseudonymization

What do the Hollywood blockbuster "The Imitation Game - A Top Secret Life" and Data protection in common? Both are about data or personal data from unauthorized access by third parties. They prove that data protection can also offer Hollywood-style excitement. In the following lines, we would like to show you how you can possibly save yourself a lot of "drama" with the supervisory authorities.

First, we would like to briefly explain the differences between anonymized and pseudonymized data. We will then explain why you should consider this topic.

What is anonymized data?

Compared to pseudonymized data, anonymized data does not enjoy the privilege of a so-called "legal definition" in the GDPR. This means that there is no definition of anonymized data in the GDPR gives.

Anonymized data is generally understood to be data that has no personal reference (surname, first name, email address, tax ID, etc.). However, when such a personal reference is to be denied has been a matter of dispute for some time and is subject to the uncertainties of technological progress. When formulating the GDPR has deliberately decided to dispense with a legal definition and leave this responsibility to users, supervisory authorities and the courts. In summary, the discussion revolves around which standard should apply to the "personal reference". If one focuses solely on whether the specific data processing responsible The subjective theory is whether a personal reference is to be denied at a certain point (subjective theory) or whether the theoretical possibility that someone establishes a personal reference in some way and with the aid of all possible means is sufficient to affirm this (objective theories).

According to recital 26 of the GDPR must first consider the means and knowledge of the responsible body for the purpose of establishing the personal reference, but then also examine whether it would also reasonably obtain additional knowledge that is objectively and legally available. The European legislator is trying to find a compromise here.

A data record can therefore be anonymous for one body and have a personal reference for another body.

If in doubt, you should therefore not regard the data set as anonymous and take appropriate security measures in accordance with the requirements of the GDPR and national data protection regulations.

Now that we have taken a closer look at anonymous data, we would like to turn our attention to its little brother, pseudonymized data.

What is a Pseudonymization and what is pseudonymized data?

Thankfully, these are indirectly described in Art. 4 No. 5 GDPR explained. "Pseudonymization" is described as the Processing personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

Pseudonymized data is therefore personal datawhose direct personal reference has been replaced by a pseudonym (e.g. "C3PO" instead of "Martin Mustermann" or the personnel number instead of the name), but is still indirectly present. This pseudonym can be converted into a direct personal reference using a tool.

When assessing whether a data set has been sufficiently alienated or pseudonymized, as with the assessment of anonymous data sets, the current status of the data set plays an important role. State of the art an important role. A guideline with clear rules or supporting software for the Pseudonymization and defined access authorizations are required to secure the Pseudonymization helpful.

What is the difference between anonymized and pseudonymized data?

In contrast to merely pseudonymized data, anonymized data no longer contains any personal reference. They therefore no longer fall within the scope of the GDPRif no natural person can be identified with their help at the time of the assessment. Please note, however, that this assessment may turn out differently at a later date.

In contrast to anonymized data, pseudonymized data still falls within the scope of the GDPR and other data protection laws such as the BDSG and the TTDSG. With these, the personal reference is still contained in the pseudonym and a natural person can still be identified.

Why should you deal with Pseudonymization and pseudonymized data?

Although pseudonymized data is subject to data protection, working with pseudonymized data records is easier under data protection law. Thus the Pseudonymization of data records as additional protective measures that can be taken to protect data using Standard contractual clauses to the USA in compliance with data protection regulations. Furthermore, the Pseudonymization from personal data a technical and organizational protection measure pursuant to Art. 32 para. 1 lit. a GDPRwhich are used for the safety of the Processing of personal data.

When weighing up the legitimate interest in accordance with Art. 6 para. 1. sentence 1. lit. f GDPR this is more likely to be in your favor if you only use pseudonymized data.

Through the Pseudonymization data, you can also significantly reduce your data protection risks and the risks for the data subject.

The advantages are even greater with anonymized data. As previously mentioned, anonymized data frees you from the "constraints" of data protection. You do not need to Processing of anonymized data has no legal basis. Among other things, you do not have to comply with the principles of Data minimization and can store the anonymized data records indefinitely. If anonymized data records are stolen, you generally do not have to report this to your competent data protection supervisory authority.

From a data protection perspective, you should ask yourself whether you can work with anonymized or at least pseudonymized data for every analysis and statistic that you carry out or collect in your company.

Such data records are often sufficient to analyze general customer or click behavior on websites, for example, and to develop corresponding optimization strategies.

Our experience also shows that anonymized and pseudonymized data records are often completely sufficient for carrying out statistical surveys on sales figures, employee parking space occupancy or the most popular canteen food, for example.

Employees often develop new solutions to known problems when working with anonymized data sets, as they are not restricted by real names.

For questions about Anonymization or Pseudonymization of your customer data, Employee data or other data, we will be happy to advise you.

Tags: