Problems relating to what data/images/information can be consider anonymous is one of the major data protection issues of privacy law having an impact in any sector including the Internet of Things, eHealth and on any activity that tries to rely on Big Data or in general large databases. And the Article 29 Working Party, a consultancy body of the European Commission on data protection matters, issued an opinion on anonymization techniques identifying what kind of conducts convert identifiable data into anonymous data for privacy law purposes in order to give guidelines on the topic.
Just last week I was discussing with a client from a major medical devices company about the possibility to qualify as anonymous data the images showing patients’ organs during a surgery whose identification codes on the relative DVDs were then randomized to prevent the possibility to link the images to the relative patient. And indeed based on my experience the most active discussions with clients are on this topic.
Usually clients tend to broaden the qualification of anonymous data and lawyers to narrow it down as much as possible. I am certainly not objective, but it is true that the definition of “personal data” under EU laws is very broad since they are defined as
“any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity“
And the reference to data that even “indirectly” can be linked to an individual creates most of the issues. According the EU Data Protection Directive 95/46 in assessing whether a person is identifiable through the processed data, account should be taken of all the means “likely reasonably” to be used either by the controller or by any other person to identify the said person.
In this respect, while pseudonymised data can still be deemed to be personal data as they can be connected to the individual they refer to linking the pseudonym to the name of the individual to whom it referred, the answer if randomization or generalization techniques are used is less straight-forward and depends on the peculiarities of the case and the technique used for the anonymization. Additionally, the issue is that anonymization techniques which are considered to be effective as of today might not be anymore in a couple of years with the development of technologies. Therefore data protection obligations might become later on an issue for companies that assumed to have overcome their restrictions.
In any case, it should be considered that according to the Article 29 Working Party even if data protection laws do not apply to anonymous data they might be still subject to confidentiality obligations and therefore their storage shall be authorized by the individual to which the data refer. Likewise the usage of anonymization techniques is deemed to be per se a data processing activity relevant for the purposes of data protection laws and therefore if this was not performed in compliance with privacy laws it might be challenged and fined.
This is a very interesting topic that will require a case by case review of the peculiarities of each circumstance.