The CJEU rules that personal data can be pseudonymous in the hands of one party and anonymous in the hands of another....more
The Single Resolution Board ("SRB") transferred pseudonymized comments from data subjects to Deloitte without informing them. The European Data Protection Supervisor ("EDPS") found a violation of information duties applicable...more
The Federal Trade Commission (FTC) has a long-standing habit of creating legal obligations through blog posts. Recent communications from the FTC by way of its Office of Technology Blog evidence an aggressive expectation...more
As we’ve written about before, the question of anonymization can be tricky. When is something “anonymized” or merely “de-identified” or “pseudonymous” — and when does it matter? This is a particularly fraught issue under...more
Research participants must identify which data sets constitute personal data to ensure compliance with the GDPR. The UK Medical Research Council (MRC) has published a useful guidance note on the identifiability,...more