ICO call for views: Anonymisation, pseudonymisation and privacy enhancing technologies guidance

Effective anonymisation techniques provide a privacy-friendly alternative to sharing personal data.  Organisations must, however, be reasonably confident that disclosing or sharing apparently anonymous information will not lead to the inappropriate disclosure of personal data, for example through ‘re-identification’. 

With this in mind, the ICO is calling for views on the first draft chapter of its new guidance on anonymisation, pseudonymisation and privacy enhancing technologies. The chapter is an introduction to anonymisation and provides definitions of anonymisation and pseudonymisation.  It explores the legal, policy and governance issues around the application of anonymisation and pseudonymisation in the context of data protection law.

The guidance will be useful for organisations considering anonymising otherwise personal information helping them to assess and mitigate the risks that may arise. The guidance will be relevant for example, where any entity is:

  • required by law to publish anonymous information, e.g. some health service bodies;
  • looking to use data in new and innovative ways, e.g. to improve services or collect large volumes of data to train AI models; or
  • looking to provide anonymous information for research purposes, or to enable wider social benefits.
Anonymisation 

Anonymous information is the end result of a process that converts personal data, which identifies an individual, to information that data protection legislation no longer applies to.  Anonymisation is the way in which personal data is turned into anonymous information.

Data protection law requires that information is ‘effectively anonymised’ before it can be processed outside the reach of data protection law. This requirement does not mean that anonymisation is entirely without risk, as long as the entity handling the data can mitigate the risk of re-identification until it is sufficiently remote.

The draft chapter provides guidance on the benefits of anonymisation, noting that anonymisation is important as it limits data protection risks and supports the principle of data minimisation. Ultimately, it allows for disclosure of information to other organisations and use of anonymised information more freely as fewer legal restrictions apply.

Anonymisation v pseudonymisation 

The draft chapter also outlines the way in which pseudonymisation differs from anonymisation. Pseudonymisation is a technique that replaces or removes information which identifies an individual. For example, removing names and replacing them with a reference number. The additional information (the names) must be kept separately in a secure manner. This means that individuals are not identifiable from the pseudonymous dataset itself, but they can be identified by referring to the additional information held separately.  In contrast to anonymisation, pseudonymous data is classed as personal data and data protection law is still applicable.

Consultation 

The ICO intends to publish further draft chapters on its new guidance for comment throughout the summer and autumn.  The ICO is inviting feedback in order to develop the guidance further prior to its publication at the end of this year. Feedback can be provided until 28 November 2021 via anonymisation@ico.org.uk.  

How can we help?

Our specialist Data Protection & Cyber Security team can assist you if you are considering sharing personal data or using privacy enhancing techniques such as anonymisation or pseudonymisation.   

This article was co-written by Clare Tuohy, Trainee Solicitor.

Latest updates from @MacRoberts

  • MacRoberts is delighted to be shortlisted at this year’s Scottish Legal Awards! We're up for Firm of the Year & t… https://t.co/LfaBwKCeXC 19 hours ago
  • Have you and your partner been considering moving in together? Are you aware of the legal implications that this ma… https://t.co/BCgW2nHnCR 23 hours ago
  • Following a consultation in 2019, the UK Government has outlined its intention to introduce a mandatory duty on emp… https://t.co/2XBrafRQ22 29/07/2021
  • Our award-winning Family Law team can help you and your partner through difficult situations by providing support w… https://t.co/sOwEmv13fP 27/07/2021
  • To celebrate the Olympic Games in Tokyo, we're delighted to launch our latest sporting challenge in support of our… https://t.co/Y8IEq3eT53 23/07/2021
  • MacRoberts is recruiting! We are currently looking for a Real Estate Planning Solicitor to join the MacRoberts tea… https://t.co/ioGQaF2hQc 23/07/2021
  • The countdown is on! With just 100 days to go, we’re looking forward to #COP26 in Glasgow! ♻️ As a firm accredite… https://t.co/Ooldhmo8tW 22/07/2021
  • Has lockdown led you to consider a move to the countryside? From discussing a possible purchase to obtaining the… https://t.co/patbF42pjk 22/07/2021
  • Have you seen our latest vacancies? 💼 We currently have opportunities in various departments across the firm. Fin… https://t.co/NpiWs2sphg 21/07/2021
  • Acas has published new guidance for employers with helpful information on #flexibleworking & #hybridworking. With t… https://t.co/SoX87hFkko 20/07/2021
  • Busting the myth that a career in law is only for the privileged few: @marikaflawyer is speaking at this morning’s… https://t.co/awfcub4cw0 19/07/2021
  • MacRoberts is recruiting! We are currently looking for a Support Services Assistant to join our team in Edinburgh.… https://t.co/DJ27fRmmdb 16/07/2021
  • MacRoberts is pleased to have been part of the team advising @HV_Systems in its £5m capital boost from Beehive Equi… https://t.co/BxcwjCgIVk 15/07/2021
  • MacRoberts is recruiting! We are currently looking for a NQ Solicitor to join our Conveyancing & Private Client te… https://t.co/zubGY4zo0D 14/07/2021
  • For the last of our IGTV mini-series, we hear from Katie MacLeod. She will be giving an insight into what it’s like… https://t.co/0v2nNQ9zzZ 14/07/2021