Regulation and data
Pseudonymisation
Pseudonymisation means processing personal data so that they can no longer be attributed to a person without additional information that is kept separately and protected (art. 4.5 of the GDPR). Pseudonymised data are still personal data; anonymous data are not.
Also known aspseudonymization · pseudonymised data · seudonimización
Pseudonymous or anonymous: the difference that matters
An example from a residence: a fault report by room in which each resident appears as "R-0412", and the table saying who R-0412 is is held only by the office. Whoever reads the report does not know who is being discussed; the centre does. That is pseudonymisation. Recital 26 makes it clear: those data are information about an identifiable person, and the GDPR still applies to them in full.
| Pseudonymised | Anonymous | |
|---|---|---|
| Can you get back to the person? | Yes, with the additional information kept separately | No, by any means reasonably likely to be used |
| Does the GDPR apply? | Yes (recital 26) | No (recital 26) |
| What it is for | Reducing risk, as a data protection by design measure (art. 25.1) and a security measure (art. 32.1.a) | Statistics or studies that no longer process personal data |
Recital 28 adds that pseudonymisation reduces the risks to data subjects and helps compliance, but that it does not rule out any other measure: it does not make lawful a processing operation that had no legal basis, nor does it exempt the centre from the record or from the duty to inform.
Worth knowing
Swapping a name for a code is not enough if the code can be undone. A hash of an ID number or a phone number looks like a pseudonym, but anyone holding the centre's list of phone numbers can compute the same hashes and match them. The AEPD, the Spanish data protection authority, published with the European Data Protection Supervisor an introduction to hashing as a pseudonymisation technique that asks for that re-identification risk to be analysed case by case. To protect what is stored as well, it is combined with encryption.
Sources
Related terms
- GDPRThe GDPR is Regulation (EU) 2016/679, the EU rule that governs the processing of personal data. It has applied directly since 25 May 2018, and in Spain the LOPDGDD completes it. It binds a colegio mayor, a private student residence and a coliving in exactly the same way.
- EncryptionEncryption is the technique that turns data into text nobody can read without the key. The GDPR names it among the security measures of its art. 32 and gives it a practical effect: if encrypted data are lost and the key is safe, it may not be necessary to tell each person affected.