Share This Article
Problems relating to what data/images/information can be considered anonymous is one of the significant data protection issues of privacy law having an impact in any sector, including the Internet of Things, eHealth, and on any activity that tries to rely on Big Data or in large general databases.
And the Article 29 Working Party, a consultancy body of the European Commission on data protection matters, issued an opinion on anonymization techniques identifying what kind of conducts convert identifiable data into anonymous data for privacy law purposes to give guidelines.
Just last week, I was discussing with a client from a major medical devices company about the possibility of qualifying as anonymous data the images showing patients’ organs during surgery whose identification codes on the relative DVDs were then randomized to prevent the possibility of linking the images to the relative patient. And indeed, based on my experience, the most active discussions with clients are on this topic.
Usually, clients broaden the qualification of anonymous data, and lawyers narrow it down as much as possible. I am certainly not objective, but the definition of “personal data” under EU laws is indeed very broad since they are defined as
“any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity”
And the reference to data that even “indirectly” can be linked to an individual creates most of the issues. According to the EU Data Protection Directive 95/46, in assessing whether a person is identifiable through the processed data, an account should be taken of all the means “likely reasonably” to be used by the controller or any other to identify the said person.
In this respect, while pseudonymized data can still be deemed to be personal data as they can be connected to the individual they refer to, linking the pseudonym to the name of the individual to whom it referred, the answer if randomization or generalization techniques are used is less straight-forward and depends on the peculiarities of the case and the technique used for the anonymization. Additionally, the issue is that anonymization techniques considered effective today might not be anymore in a couple of years with the development of technologies. Therefore data protection obligations might become later on an issue for companies that are assumed to have overcome their restrictions.
In any case, it should be considered that according to Article 29 Working Party, even if data protection laws do not apply to anonymous data, such data might still be subject to confidentiality obligations. Therefore their storage shall be authorized by the individual to which the data refers. Likewise, using anonymization techniques is deemed to be, per see, a data processing activity relevant to data protection laws. Therefore, it might be challenged and fined if this was not performed in compliance with privacy laws.
This fascinating topic will require a case-by-case review of the peculiarities of each circumstance.
