Feeds

Anonymous means NO identifying element left behind – EU handbook

Different test from UK's ICO, which doesn't require 'risk-free' anonymisation

Secure remote control for conventional and virtual desktops

A new handbook on European data protection laws contains a different test from the one used by the UK's Information Commissioner's Office (ICO) for determining whether data is personal or anonymised for the purposes of data protection law.

The new handbook (214-page/3.08MB PDF) has been issued jointly by the European Union Agency for Fundamental Rights, the Council of Europe and the Registry of the European Court of Human Rights. European Commission officials responsible for data protection matters and the European Data Protection Supervisor also had an input in its drafting.

The document is non-binding but is designed to "raise awareness and improve knowledge of data protection rules in European Union and Council of Europe member states". The Council of Europe (CoE) promotes collaborative legal standards in the areas of human rights between all European countries. It has 47 member countries and is separate from the EU.

EU data protection rules apply to the personal data of living "data subjects". The rules do not apply where that data has been anonymised.

Absolute anonymisation has become increasingly difficult in recent times due to the increasing volumes of data being generated and the availability of powerful technologies that allow information from one data set to be linked to information elsewhere.

A code of practice issued by the ICO in November 2012 accounted for this discrepancy between full anonymisation and "anonymisation" for the purposes of setting aside the application of data protection laws to data.

The ICO explained that the Data Protection Act (DPA) in the UK "does not require anonymisation to be completely risk free". It said that providing there is no more than a "remote" chance that data subjected to anonymisation measures can be traced back to individuals then, for the purposes of the law, that data would be treated as having been anonymised and no longer constituting "personal" data.

"If the risk of identification is reasonably likely the information should be regarded as personal data," the ICO said.

The watchdog's code made clear that the ICO would be unlikely to take enforcement action against organisations that disclose data they believe to have been anonymised when in fact it was not where those organisations could show they had "made a serious effort to comply with the Data Protection Act (DPA) and had genuine reason to believe that the data it disclosed did not contain personal data or present a re-identification risk".

However, the new data protection handbook issued by the three European bodies contains a different test for defining when personal data can be said to have been anonymised.

"Data are anonymised if all identifying elements have been eliminated from a set of personal data," according to the handbook. "No element may be left in the information which could, by exercising reasonable effort, serve to re-identify the person(s) concerned. Where data have been successfully anonymised, they are no longer personal data."

The effort required to connect so-called anonymised data to an individual is something that the Hamburg data protection authority has said it considers when assessing whether data is anonymised for the purposes of deciding whether data protection laws should apply to it.

"Our general stance towards anonymisation is not far off of that of our British colleagues," a spokesman for the Hamburg authority told Out-Law.com previously. "German privacy law defines 'rendering anonymous' as 'the alteration of personal data so that information concerning personal or material circumstances cannot be attributed to an identified or identifiable natural person or that such attribution would require a disproportionate amount of time, expense and effort'.

"It is therefore acknowledged that the absolute impossibility for re-identification in practice cannot always be achieved. Obviously this is addressed by the ICO in terms of a 'remote risk' remaining," he added.

Many organisations that collect personal data anonymise that information after they no longer have need for the information in personalised form. Anonymised data, unlike personal data, can be retained by businesses for as long as they like or sold or shared freely with other organisations without that activity being governed by sometimes restrictive data protection rules.

Anonymised data can be helpful to businesses for analytic purposes, to identify trends and general consumer behaviour.

Copyright © 2014, Out-Law.com

Out-Law.com is part of international law firm Pinsent Masons.

Intelligent flash storage arrays

More from The Register

next story
Scrapping the Human Rights Act: What about privacy and freedom of expression?
Justice minister's attack to destroy ability to challenge state
WHY did Sunday Mirror stoop to slurping selfies for smut sting?
Tabloid splashes, MP resigns - but there's a BIG copyright issue here
DVLA website GOES TITSUP on day paper car tax discs retire
Welcome to GOV.UK - digital by de ... FAULT
Hey Brit taxpayers. You just spent £4m on Central London ‘innovation playground’
Catapult me a Mojito, I feel an Digital Innovation coming on
Google hits back at 'Dear Rupert' over search dominance claims
Choc Factory sniffs: 'We're not pirate-lovers - also, you publish The Sun'
EU to accuse Ireland of giving Apple an overly peachy tax deal – report
Probe expected to say single-digit rate was unlawful
Inequality increasing? BOLLOCKS! You heard me: 'Screw the 1%'
There's morality and then there's economics ...
While you queued for an iPhone 6, Apple's Cook sold shares worth $35m
Right before the stock took a 3.8% dive amid bent and broken mobe drama
EU probes Google’s Android omerta again: Talk now, or else
Spill those Android secrets, or we’ll fine you
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.