This browser is not actively supported anymore. For the best passle experience, we strongly recommend you upgrade your browser.
viewpoints
Welcome to Reed Smith's viewpoints — timely commentary from our lawyers on topics relevant to your business and wider industry. Browse to see the latest news and subscribe to receive updates on topics that matter to you, directly to your mailbox.
| 1 minute read

EDPS & Spanish DPA busting myths on anonymisation

The EDPS and the Spanish data protection authority (the AEPD) published a joint paper on "10 misunderstandings related to anonymisation" to provide for guidance for organisations using anonymisation as a means to protect personal data, e.g. for transfers. After briefly bringing the reader up to speed as to what anonymisation is and why it is relevant for various sectors, the EDPS and AEPD give attention to the following 10 "misunderstandings":

  1. "Pseudonymsation and anonymisation are the same": False, as pseudonymisation allows for identification of individuals, anonymisation does not (if done correctly).
  2. "Encryption is anonymisation": False, as encryption is a technical means to prevent access to data, but does not render it unidentifiable.
  3. "Anonymisation of data is always possible": False, as datasets may become useless under specific circumstances if the data is anonymised.
  4. "Anonymisation is forever": False, as new technologies or additional data may allow for re-identification in the future.
  5. “Anonymisation always reduces the probability of re-identification of a dataset to zero": False, although this is the desired outcome of anonymisation measures, this cannot be guaranteed in all cases.
  6. "Anonymisation is a binary concept that cannot be measured": False, as it is possible to measure and analyze the degree of anonymisation.
  7. "Anonymisation can be fully automated": False, as human expert intervention is required together with automated technological tools.
  8. "Anonymisation makes the data useless": False - if done properly, the datasets can still be used for the intended purpose.
  9. "Following an anonymisation process that others used successfully will lead our organisation to equivalent results": False, as the process needs to be tailored for the specific purpose, data, risks etc.
  10. "There is no risk and no interest in finding out to whom this data refers to": False, as (personal) data is of great value and re-identification may be of risk for individuals' rights and freedoms.

All in all the paper is an interesting read even for privacy pros, but particularly for organisations using or planning to use anonymisation techniques.

However, along with its growing popularity, some misconceptions related to anonymization have become widespread.  The objective of this document is to raise awareness about some misunderstandings about anonymisation, and to motivate its readers to check assertions about the technology, rather than accepting them without verification.

Tags

anonymisation, anonymization, personal data, edps, aepd, data security, tech & data

Latest Insights