Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
As per GDPR, we need to pseudonymize the name and email address. How can we pseudonymize name and email address? For example, is the below is correct way to pseudonymize?
Steve Anderson Stxxx Axxdxrxn
test@testdomain.com txxx@xxxxxxxxxx.com
Is the above definition of pseudonymize is correct? Or we can reduce or increase the number of characters like,
Steve Anderson Sxxx xxxrxn
I want to implement this in my code but don't now how can I implement pseudonymized Name and Email properly.
The GDPR does not prescribe how information should be pseudonymized and does not even define the term properly. Yet, pseudonymization is suggested as an safety measure in various places, so that pseudonymization should be implemented wherever appropriate.
The most useful guidance the GDPR gives is by contrasting pseudonymization with anonymization, where it says that pseudonymized data is still personal data because the data subjects can be identified using additional information (see Recital 26 GDPR). In contrast, re-identification is not reasonably likely for truly anonymized data.
A common technique for pseudonymization is to replace identifying information with a pseudonym, for example replacing a name with a random numeric ID. However, this can only be considered pseudonymous if the mapping between the ID and the real value is not available to whoever uses this data.
Replacing individual fields in a data set might not be sufficient for pseudonymization because apparently non-sensitive fields could still enable indirect identification. This requires careful analysis taking into account the entire context of the data, so it isn't possible to say whether merely removing names + email addresses achieves pseudonymization or anonymization.
What you are doing is redacting parts of sensitive data. I think this is a pretty weak pseudonymization method since it still leaks partial information about the true value, and leaks information about the length of the redacted value. It is possible to argue that this is OK (e.g. if you can show that you have multiple similar redactions so that you achieve a level of k-anonymity). But by default, such partial redactions are likely to be unsafe. Completely removing the sensitive data is much safer.
The “Article 29 Working Party”, a pre-GDPR EU body, has published an opinion on anonymization techniques in 2014 (PDF). It does not account for the GDPR's specific phrasing, but provides an overview of pseudonymization and anonymization techniques and puts them into context of European data protection law. It considers how such guarantees guard against attacks such as singling out data subjects, linking multiple records of the same individual, and making inferences about the data subject.
In this guidance, pseudonymization techniques that are suggested include encrypting or hashing the sensitive data. However, the guidance warns that such techniques do not provide strong protection against singling out or linking records of the data subject.
A bit earlier, the UK ICO had published guidance on personal data, including on the matter of anonymization and pseudonymization (PDF) with some good examples. For determining whether a data set has been successfully anonymized (or pseudonymized), they suggest a motivated intruder test: could someone without specialist knowledge or skills re-identify the data subject? In your example, such a person should not be able to infer that a record about Stxxx Axxdxrxn is about a Steve Anderson. In my opinion, your pseudonymization approach would fail the motivated intruder test unless you have multiple records that could all be about Steve Anderson (compare k-anonymity).
First of all, the GDPR doe not require you to pseudonymize anything. It requires that "appropriate" security measures be used. It also required that when Personal Data (which I shall call PI) is processed (which includes storing PI) that there be a lawful basis, as described in GDPR Article 6. The person's consent is one of the six possible lawful bases.
Second, while using pseudonymous data may be a good security practice, and is recommended by the GDPR, such data is still PI (and often PII, Personally Identifiable Information) and still requires a lawful basis for any processing. PI also requires that the Data Subject (DS) be notified when it is collected (Article 13 and Article 14, and that the DS has the "right to Know" (Article 15), "right to modify" (Article 16), and "right of erasure" (Article 17), and proper security must still be used on pseudonymized PI.
To convert PI into something that is not PI, where these rights and requirements do not apply, the data must be so modified that it is not reasonably possible, given current technology, to re-associate the modified data with the person that they represent, either directly or with the assistance of other data held by others than the Data Controller (DC). It must also not be possible to "single out" the DS. That is, if you suspect that the DS is a specific person X, it must not be possible to confirm this using the modified data. A hash, for instance, is not good enough, because if you suspect a particular person, you can hash that person's info and compare, and if you are correct there will be a match. If you can eliminate many of the possible suspects, leaving a much smaller pool, that is also singling-out, and means that the data has not been successfully anonymized. Data so modified is said to be anonymized, not just pseudonymous. Data that has been successfully anonymized is not subject to the security or notification requirements of the GDPR.
The GDPR does not specify any particular methods that may be used to anonymize PI. Certainly anything that leaves a recognizable name in the modified data is not good enough. Even recognizable initials would mean that the modified data has not been anonymized. Because that would allow someone the drastically limit which of a group of suspected people the PI belongs to. That is "singling out".
It should be assumed that an attacker knows any and all algorithms used to anonymize data, and if the attacker can re-identify or single-out the DS with this knowledge, plus other potentially available information, then the data has not been successfully anonymized.
To judge if an algorithm successfully anonymizes data, one would need the details of the algorithm, and an idea of other information which might be available to use in re-identifying the data. To anonymize data is not a simple or trivial task, and any DC who depends on it must be prepared to demonstrate that there is no reasonable way to re-identify or single out the DS from the anonymized data,
Nor does the GDPR ever require anonymization. If the DC abides by the requirements in handling PI and PII, there is no need for it at all.
