What are anonymous data?

more+
less-

Problems relating to what data/images/information can be consider anonymous is one of the major data protection issues of privacy law having an impact in any sector including the Internet of Things, eHealth and on any activity that tries to rely on Big Data or in general large databases. And the Article 29 Working Party, a consultancy body of the European Commission on data protection matters, issued an opinion on anonymization techniques identifying what kind of conducts convert identifiable data into anonymous data for privacy law purposes in order to give guidelines on the topic.

Just last week I was discussing with a client from a major medical devices company about the possibility to qualify as anonymous data the images showing patients’ organs during a surgery whose identification codes on the relative DVDs were then randomized to prevent the possibility to link the images to the relative patient. And indeed based on my experience the most active discussions with clients are on this topic.

Usually clients tend to broaden the qualification of anonymous data and lawyers to narrow it down as much as possible. I am certainly not objective, but it is true that the definition of “personal data” under EU laws is very broad since they are defined as

any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity

And the reference to data that even “indirectly” can be linked to an individual creates most of the issues. According the EU Data Protection Directive 95/46 in assessing whether a person is identifiable through the processed data, account should be taken of all the means “likely reasonably” to be used either by the controller or by any other person to identify the said person.

In this respect, while pseudonymised data can still be deemed to be personal data as they can be connected to the individual they refer to linking the pseudonym to the name of the individual to whom it referred, the answer if randomization or generalization techniques are used is less straight-forward and depends on the peculiarities of the case and the technique used for the anonymization. Additionally, the issue is that anonymization techniques which are considered to be effective as of today might not be anymore in a couple of years with the development of technologies. Therefore data protection obligations might become later on an issue for companies that assumed to have overcome their restrictions.

In any case, it should be considered that according to the Article 29 Working Party even if data protection laws do not apply to anonymous data they might be still subject to confidentiality obligations and therefore their storage shall be authorized by the individual to which the data refer. Likewise the usage of anonymization techniques is deemed to be per se a data processing activity relevant for the purposes of data protection laws and therefore if this was not performed in compliance with privacy laws it might be challenged and fined.

This is a very interesting topic that will require a case by case review of the peculiarities of each circumstance.


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© DLA Piper | Attorney Advertising

Written by:

more+
less-

DLA Piper on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:

Sign up to create your digest using LinkedIn*

*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.
×
Loading...
×
×