Pseudo Vs Anon Data

Pseudonymised vs Anonymised Data Classification

Overview

The distinction between pseudonymised and anonymised data is one of the most consequential classifications in data protection law. Pseudonymised data remains personal data subject to the full GDPR (Art. 4(5), Recital 26). Anonymised data falls outside the GDPR entirely (Recital 26). The boundary between them determines whether processing requires a lawful basis, whether data subjects can exercise rights, and whether the data can be freely shared. This skill provides the analytical framework for making this determination, drawing on the CJEU Breyer ruling (C-582/14), the Article 29 Working Party Opinion 05/2014 on Anonymisation Techniques (WP216), and the ICO motivated intruder test.

Legal Definitions

Pseudonymisation — Art. 4(5)

"The processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person."

Key characteristics:

• Data has undergone a transformation (tokenisation, hashing, encryption)
• A re-identification key or method exists
• The key is kept separately from the data
• Technical and organisational controls protect the key
• The data REMAINS personal data under GDPR

Anonymisation — Recital 26

"The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable."

Key characteristics:

• No means exist that are reasonably likely to be used for identification
• Assessment considers ALL means reasonably likely, including third-party means
• Assessment accounts for cost, time, and available technology
• Assessment considers technological developments over the data retention period
• Truly anonymised data is NOT personal data — GDPR does not apply

The Three-Criteria Test — WP29 Opinion 05/2014 (WP216)

The Article 29 Working Party established three criteria for evaluating whether anonymisation is effective. Data is NOT anonymised if ANY of the three attacks can succeed:

Criterion 1: Singling Out

Definition: The possibility of isolating some or all records that identify an individual in the dataset.

Test: Can a specific individual be distinguished from all other individuals in the dataset?

Examples of failure:

• A dataset with unique combinations of age, postcode, and gender that correspond to only one person in the population
• A dataset with unique transaction patterns that correspond to a single customer
• Removing a name but retaining a rare medical condition in a small geographic area

Mitigation techniques: k-anonymity (ensure at least k individuals share each combination of quasi-identifiers), aggregation to sufficiently large groups

Criterion 2: Linkability

Definition: The ability to link at least two records concerning the same data subject or a group of data subjects, either within the same dataset or between two separate datasets.

Test: Can records be combined across datasets to build a profile of an individual?

Examples of failure:

• A hashed email address that can be matched across two datasets released by the same controller
• A dataset with date of birth, postcode, and hospital visit date that can be linked to public voter registration records
• Transaction patterns that can be matched with social media activity timestamps

Mitigation techniques: l-diversity, t-closeness, differential privacy noise addition, removing linkable quasi-identifiers

Criterion 3: Inference

Definition: The possibility of deducing, with significant probability, the value of an attribute from the values of a set of other attributes.

Test: Can sensitive information about an individual be inferred from the released data?

Examples of failure:

• A dataset shows that all patients in a particular age-postcode group have the same diagnosis
• Salary data for a small department where only one person holds a particular role
• Aggregate statistics with small cell sizes that reveal individual values

Mitigation techniques: t-closeness (ensure attribute value distribution in each equivalence class is close to the overall distribution), differential privacy, cell suppression for small groups

Assessment Matrix

All three criteria must be satisfied for data to qualify as anonymised.

The Motivated Intruder Test (ICO)

The ICO supplements the WP29 framework with the "motivated intruder" test:

The motivated intruder is:

• A person who starts without any prior knowledge of the data subject
• Has access to the dataset and to publicly available resources (internet, public registers, social media, published statistics)
• Has reasonable competence and motivation to re-identify (not a specialist)
• Does NOT have access to specialist equipment, techniques, or insider knowledge
• Would invest reasonable time and effort (days, not months)

If the motivated intruder could re-identify any individual: the data is NOT anonymised.

This test provides a practical complement to the WP29 criteria by establishing a baseline attacker model for the "reasonably likely means" assessment under Recital 26.

Anonymisation Techniques — Effectiveness Assessment

Technique 1: Randomisation (Noise Addition)