The ICO has published guidance on anonymisation and pseudonymisation. The ICO notes the importance of anonymisation techniques to provide a privacy-friendly alternative to data sharing but not to the extent that this should avoid compliance with the law.
The guidance gives an overview of anonymisation techniques and their strengths and weaknesses. It also assesses the suitability of the use of anonymisation in particular situations, including case studies. The main benefits of anonymisation include protecting people’s identities, greater security and improved risk reduction relating to the disclosure or publication of personal data.
The guidance also covers pseudonymisation, which replaces information that directly identifies people. This might include replacing names or identifiers with resource numbers. Pseudonymisation should not be confused with anonymisation. Pseudonymisation is a way of reducing risk and improving security but not a way of transforming personal data to the extent the law no longer applies. So for example if you use a number identifier that attaches to a living person the data relating to that number identifier must be released in compliance with a subject access request under the Data Protection Regulation.
The guidance includes advice on accountability and governance measures for organisations and deals with the role that anonymisation plays in the three regimes of data protection law:
- General processing under Part 2 of the Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR).
- Law enforcement processing under Part 3 DPA 2018.
- Intelligence services processing under Part 4 DPA 2018.
Although the guidance is not statutory and there is no penalty for not following the recommendations, the ICO will take it into account when looking into an issue about anonymisation.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation
