Are ‘pseudonymised’ data always personal data? Implications of the GDPR for administrative data research in the UK
There has naturally been a good deal of discussion of the forthcoming General Data Protection Regulation. One issue of interest to all data controllers, and of particular concern for researchers, is whether the GDPR expands the scope of personal data through the introduction of the term ‘pseudonymis...
| Main Authors: | , , , , , , , , |
|---|---|
| Format: | Journal article |
| Published: |
Elsevier
2018
|
| _version_ | 1797091499348852736 |
|---|---|
| author | Mourby, M Mackey, E Elliot, M Gowans, H Wallace, S Bell, J Smith, H Aidinlis, S Kaye, J |
| author_facet | Mourby, M Mackey, E Elliot, M Gowans, H Wallace, S Bell, J Smith, H Aidinlis, S Kaye, J |
| author_sort | Mourby, M |
| collection | OXFORD |
| description | There has naturally been a good deal of discussion of the forthcoming General Data Protection Regulation. One issue of interest to all data controllers, and of particular concern for researchers, is whether the GDPR expands the scope of personal data through the introduction of the term ‘pseudonymisation’ in Article 4(5). If all data which have been ‘pseudonymised’ in the conventional sense of the word (e.g. key-coded) are to be treated as personal data, this would have serious implications for research. Administrative data research, which is carried out on data routinely collected and held by public authorities, would be particularly affected as the sharing of de-identified data could constitute the unconsented disclosure of identifiable information. Instead, however, we argue that the definition of pseudonymisation in Article 4(5) GDPR will not expand the category of personal data, and that there is no intention that it should do so. The definition of pseudonymisation under the GDPR is not intended to determine whether data are personal data; indeed it is clear that all data falling within this definition are personal data. Rather, it is Recital 26 and its requirement of a ‘means reasonably likely to be used’ which remains the relevant test as to whether data are personal. This leaves open the possibility that data which have been ‘pseudonymised’ in the conventional sense of key-coding can still be rendered anonymous. There may also be circumstances in which data which have undergone pseudonymisation within one organisation could be anonymous for a third party. We explain how, with reference to the data environment factors as set out in the UK Anonymisation Network's Anonymisation Decision-Making Framework. |
| first_indexed | 2024-03-07T03:34:00Z |
| format | Journal article |
| id | oxford-uuid:bbad25f6-d7e9-4e37-9a65-4b60d1ad8945 |
| institution | University of Oxford |
| last_indexed | 2024-03-07T03:34:00Z |
| publishDate | 2018 |
| publisher | Elsevier |
| record_format | dspace |
| spelling | oxford-uuid:bbad25f6-d7e9-4e37-9a65-4b60d1ad89452022-03-27T05:18:43ZAre ‘pseudonymised’ data always personal data? Implications of the GDPR for administrative data research in the UKJournal articlehttp://purl.org/coar/resource_type/c_dcae04bcuuid:bbad25f6-d7e9-4e37-9a65-4b60d1ad8945Symplectic Elements at OxfordElsevier2018Mourby, MMackey, EElliot, MGowans, HWallace, SBell, JSmith, HAidinlis, SKaye, JThere has naturally been a good deal of discussion of the forthcoming General Data Protection Regulation. One issue of interest to all data controllers, and of particular concern for researchers, is whether the GDPR expands the scope of personal data through the introduction of the term ‘pseudonymisation’ in Article 4(5). If all data which have been ‘pseudonymised’ in the conventional sense of the word (e.g. key-coded) are to be treated as personal data, this would have serious implications for research. Administrative data research, which is carried out on data routinely collected and held by public authorities, would be particularly affected as the sharing of de-identified data could constitute the unconsented disclosure of identifiable information. Instead, however, we argue that the definition of pseudonymisation in Article 4(5) GDPR will not expand the category of personal data, and that there is no intention that it should do so. The definition of pseudonymisation under the GDPR is not intended to determine whether data are personal data; indeed it is clear that all data falling within this definition are personal data. Rather, it is Recital 26 and its requirement of a ‘means reasonably likely to be used’ which remains the relevant test as to whether data are personal. This leaves open the possibility that data which have been ‘pseudonymised’ in the conventional sense of key-coding can still be rendered anonymous. There may also be circumstances in which data which have undergone pseudonymisation within one organisation could be anonymous for a third party. We explain how, with reference to the data environment factors as set out in the UK Anonymisation Network's Anonymisation Decision-Making Framework. |
| spellingShingle | Mourby, M Mackey, E Elliot, M Gowans, H Wallace, S Bell, J Smith, H Aidinlis, S Kaye, J Are ‘pseudonymised’ data always personal data? Implications of the GDPR for administrative data research in the UK |
| title | Are ‘pseudonymised’ data always personal data? Implications of the GDPR for administrative data research in the UK |
| title_full | Are ‘pseudonymised’ data always personal data? Implications of the GDPR for administrative data research in the UK |
| title_fullStr | Are ‘pseudonymised’ data always personal data? Implications of the GDPR for administrative data research in the UK |
| title_full_unstemmed | Are ‘pseudonymised’ data always personal data? Implications of the GDPR for administrative data research in the UK |
| title_short | Are ‘pseudonymised’ data always personal data? Implications of the GDPR for administrative data research in the UK |
| title_sort | are pseudonymised data always personal data implications of the gdpr for administrative data research in the uk |
| work_keys_str_mv | AT mourbym arepseudonymiseddataalwayspersonaldataimplicationsofthegdprforadministrativedataresearchintheuk AT mackeye arepseudonymiseddataalwayspersonaldataimplicationsofthegdprforadministrativedataresearchintheuk AT elliotm arepseudonymiseddataalwayspersonaldataimplicationsofthegdprforadministrativedataresearchintheuk AT gowansh arepseudonymiseddataalwayspersonaldataimplicationsofthegdprforadministrativedataresearchintheuk AT wallaces arepseudonymiseddataalwayspersonaldataimplicationsofthegdprforadministrativedataresearchintheuk AT bellj arepseudonymiseddataalwayspersonaldataimplicationsofthegdprforadministrativedataresearchintheuk AT smithh arepseudonymiseddataalwayspersonaldataimplicationsofthegdprforadministrativedataresearchintheuk AT aidinliss arepseudonymiseddataalwayspersonaldataimplicationsofthegdprforadministrativedataresearchintheuk AT kayej arepseudonymiseddataalwayspersonaldataimplicationsofthegdprforadministrativedataresearchintheuk |