What is the difference between anonymisation and pseudonymisation?

What it is

Anonymisation is judged in context: who will hold the data, what other data they can access and the cost and effort of re-identification. Data can be anonymous for one recipient and personal for another. Pseudonymisation is a valuable security and minimisation measure, but it does not take data out of scope.

When data is anonymous

• No one can identify individuals from it by means reasonably likely to be used, taking account of cost, time and available technology. UK GDPR Recital 26
• The risk is assessed for each recipient and environment, and kept under review.

When it is still personal data

• You or the recipient hold, or could reasonably obtain, the key or other data to re-identify people. Art 4(5)
• Small numbers or unique combinations let individuals be singled out.

Who is responsible

The controller anonymising the data, which is processing personal data while it does so and needs a lawful basis for that.

What it involves

1. Define the release environment.
2. Apply techniques such as aggregation, generalisation and suppression.
3. Test for re-identification, including motivated intruders.
4. Keep keys separate for pseudonymised data.
5. Review as technology and available data change.

If it goes wrong

Regulatory

Treating data as anonymous when it is not means processing personal data outside the rules. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change.

Criminal

Knowingly or recklessly re-identifying de-identified personal data without the controller's consent is an offence under DPA 2018 s.171 (unlimited fine).

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.