When is pseudonymization insufficient in terms of GDPR compliance when storing and processing data for research purposes?

Question

I am working on a project where data needs to be stored and kept for further processing. It's primarily for research purposes. I know that in order to be GDPR compliant, this data has to be anonymized.

Furthermore, I know the difference between pseudonymization (the data is anonymized but the process can be reversed, e.g. encryption and the corresponding key is kept elsewhere) and anonymization (data is anonymized and there is no "direct" way to infer the initial state from the end state). However, what I have yet to find out is when to use which. Since the latter most likely yields greater information loss I am more inclined to use the former. However, if pseudonymization is sufficient then why would one use anonymization instead?

I have a suspicion that it may come down to whether a company has the resources to put additional effort into making sure that, in case of the example above, the encryption key is well protected. When it does not it might just want to anonymize the data and "be done with it".

Unfortunately, I am not sure whether I am on the right track so I would appreciate some insight.

Answer 1

The law is clear on this matter. Data for research purposes has to be fully anonymized in a way, that prevent reversing this process by anyone, so any forms of:

• pseudonymization by reversible encryption (having a proper key)
• pseudonymization by very-easy-to-brute-force hashing
• splitting into separate "users" (private) and "data" (public/research) datasets
• etc.

are not permitted.

Of course, there is next question on the way: what (and in which circumstances) is provable against you, that you deliberately didn't do full anonimization. But this is a question, that you need to answer yourself.

And, most of all, this is a matter of trust to you as a researcher.

Answer 2

What is pseudonymized and anonymized data?

Pseudonymized data is still personal data because the data subjects are (indirectly) identifiable. As such, processing pseudonymized data is still subject to the GDPR. For example, you need a clear purpose and legal basis for any such processing.

In contrast, anonymized data is no longer identifiable, so that its processing is not subject to the GDPR. You do not need a legal basis for further processing. However, the act of anonymizing is processing of personal data that needs a purpose and a legal basis.

For practical concerns (fewer compliance obligations) and because of stronger data protection for the data subjects, using anonymized data is preferable. So instead of complete records you might only use summary statistics of the dataset, like a histogram of some metric instead of the individual values.

What does the GDPR say about scientific and statistical processing?

The GDPR has fairly strong provisions for scientific and statistical purposes.

Recitals 156, 159, 162 provide background and definitions:

• scientific research purposes can be interpreted broadly and includes private sector research
• further definitions of scientific or statistical purposes may be provided by EU or member state laws
• “the statistical purpose implies that the result […] is not personal data, but aggregate data” so that the results can be freely used for other purposes

Art 89 re-emphasizes data protection requirements from Art 25 (“data protection by design and by default”), but also has opening clauses for member state law:

• such processing shall be subject to appropriate safeguards
• the processing shall respect the data minimization principle
• where possible for the processing purpose, pseudonymization is explicitly suggested as a possible safeguard (but it's neither necessary nor sufficient)
• where possible for the processing purpose, the processing shall be performed in a manner that no longer permits identification (i.e. is anonymized)
• EU member states may pass laws that exempt you from having to comply with some data subject rights (access, rectification, restriction, objection). In contrast, the right to information and erasure will still apply.

If data was collected for a different purpose than the scientific or statistical purpose you want to use it for, then Art 6(4) becomes relevant. It lists a couple of factors that affect whether the purposes are compatible.

• you cannot re-purpose data if its collection was based on consent or on legal requirements
• appropriate safeguards “which may include encryption or pseudonymisation” weigh in favour of the new purpose
• per Recital 50, “Further processing for […] scientific or […] statistical purposes should be considered to be compatible lawful processing operations.”

What should you do?

What you should do boils down to the purpose for which you are processing personal data:

• Can you achieve that purpose by using anonymized data? If so, you must apply anonymization.
  More precisely: where processing for scientific purposes doesn't require identification, you must remove identifying information. This follows from the data minimization principle that you may only collect personal data as far as it is necessary for your purposes.

• Under all circumstances, you must employ appropriate safeguards. In a scientific context this usually implies pseudonymization, but not necessarily so.

To me, it seems like your processing purpose is currently ill-defined. You say that processing would be “primarily for research purposes” and that “[anonymization] yields greater information loss”. You should disentangle the research purpose from other purposes. Per Art 6 you need a legal basis for these purposes, and a legal basis for scientific or statistical processing is easier to find. You also need to clarify the purpose so that you can determine whether you should use anonymization.

If you are in doubt whether some safeguard would be appropriate, you balance the data subject's rights and freedoms against your research interests. Stronger safeguards for the data subjects move the balance in your favour. Per Art 25 you should also consider the state of the art, the cost of implementing safety measures, and the risks for data subjects – you are not required to guarantee absolute security, just an appropriate level.

In your question you bring the example where a company would like to only use pseudonymization, but finds appropriate safety measures too expensive so that they use an anonymization approach instead. That's one way to resolve that problem, but alternatives exist: they might have also found that the proposed measures are not cost-effective for the security that they bring, or that the risks they mitigate are low-probability or low-impact for data subjects, or that alternative safety measures are more practical. The GDPR gives immense flexibility to data controllers, as long as they can demonstrate compliance. Documents like a Data Protection Impact Assessment (DPIA) per Art 35 can be helpful here.