The core difference and Reversibility and Legal Status
Pseudonymization and anonymization are different because of reversibility.
- With pseudonymization, you change a person's information for made-up names or codes. But you can still connect the information back to the person if you use other information that you have kept separate.
- Anonymization is the opposite. You change the information so that you can't ever find the person again.
Because of this difference, laws on keeping private data safe treat the two types of information differently.
- Pseudonymized data is still seen as private data. So, you must follow all the rules for private data.
- Anonymized data is not private data. So, if you do it right, you do not need to follow the same rules.
Why pseudonymised data stays within privacy law’s reach
GDPR, or the General Data Protection Regulation, recital 26 says that pseudonymized data is still personal data if you can connect it to a person using other information. This means that you must still follow all the rules of GDPR, like giving people rights to their data, having a good reason to use their data, keeping it safe, and telling people if there is a problem.
The reason for this is that pseudonymization is a way to make data safer, but it does not change what the data is. A court case with a man named Patrick Breyer showed that data is still personal if a person can be found again using "reasonable ways." Even if it is hard to find the person, the data is still under the law.
The law in India, DPDPA, is similar. It sees pseudonymized data as personal data. The law says that pseudonymization is a good way to keep data safe, but it still has power over the data because you can undo it.
When Anonymised Data Still Poses Privacy Risks
Even when data is anonymized, it can still have privacy risks because of re-identification attacks. These are ways to find the person again.
Some of these attacks are:
- Linkage attacks: This is when you put two different sets of anonymized information together to find people.
- Inference attacks: This is when you use facts about a large group to figure out private things about one person.
- Singling out: This is when a person has a special set of facts that makes them stand out from everyone else in the data.
An example of this is the Netflix case. Netflix shared information about what people watched, thinking it was safe. But people were able to match the information with public information from another website and figure out who was who.
Because of this, companies now have to do a "motivated intruder test." This test checks if a smart person with time and money could find people in the data that is supposed to be anonymous.
Regulatory Variations Across Jurisdictions
GDPR (General Data Protection Regulation)
The GDPR has the strongest rules. It says that anonymization must make it so you can never again find the person the data belongs to. The law says you must check if a person could be found again using any information that is available.
CCPA/CPRA (California Consumer Privacy Act)
The law in California uses the term "de-identified information." This is not as strong as the GDPR's rule. This law says that data should be changed so that you "cannot reasonably identify" a person. It focuses on risks that are likely, not risks that are only possible.
DPDPA (Data Protection Act)
The law in India says that anonymization must be an "irreversible process." But the law does not say what the technical rules are for this, so it is not clear how to do it.
PDPL (Personal Data Protection Act)
Singapore's law is like the others, but it says you must check for risks in the context of the data. It sees that a person's information could be found again as technology gets better and as more data is available.
Practical Implications for Risk Assessments
Organizations must think carefully about their de-identification ways when they do PIAs or DPIAs.
The main things to think about are:
- Risk Assessment Framework: You should have a clear way to see if there is a risk of a person being found again. Think about how likely it is and how bad it would be.
- Ongoing Monitoring: Privacy risks change all the time. What is private today may not be tomorrow as new information and ways of working with data become available. So, you must always be checking.
- Technical Safeguards: You must use the right tools and systems to keep the information safe. This includes things like: who can see the information, rules in contracts for how to use the information, and regularly checking to see if your safety tools are still good.
Consultant’s Analysis: The de-identified dataset scenario
This is an assessment that a data set is pseudonymized, not anonymized. This is why:
Legal Reasoning
The data set does not have names, but it does have information like location, device ID, and what a person does online. This information can be put together to find a person.
Some ways this can be done are:
- Device fingerprinting, which links different pieces of data to the same person's device.
- Location pattern analysis, which can show where a person lives or works.
- Behavioural profiling, which can make a unique digital signature for a person.
The Breyer case showed that even a changing IP address can be personal data if it is used with other information.
Practical Risk
Studies have shown that you only need four pieces of information about where a person was and when they were there to identify 95% of people. The things a person looks at online make them even more unique. This makes it very likely that a person could be found with some work.
Recommendation
Treat this data as personal data that must follow all the rules. If true anonymization is needed, here are some things to do:
- Differential privacy: Add some small, random changes to the data so that no one person can be found, but the data is still useful for a large group.
- K-anonymity: Make sure that each person's data is the same as at least k-1 other people's data. This way, no one person can be picked out.
- Generalization: Make locations less exact, for example, by only giving the city or the state instead of a person's street.
- Temporal aggregation: Put together things that happen over a longer time to make the data less unique.
- Suppression: Take out pieces of data that are very unique to one person.
The organization must also do a formal check to see if there is a risk that a person could be found again. They must use good ways to check this and put the right protections in place based on how the data will be used.
