On 10 April 2014, the Article 29 Data Protection Working Party (the "Working Party"), an independent European advisory body on data protection and privacy comprised of representatives from the national data protection authorities of the EU Member States, the European Data Protection Supervisor and the European Commission, adopted an opinion (the "Opinion") that reviews the effectiveness and limits of existing anonymisation techniques. The Opinion also offers recommendations to handle these anonymisation techniques by taking account of the residual risk of identification inherent in each of them.
The Opinion confirms that there is a growing public interest in the re-use of data. However, open data may only provide benefits for society, individuals and organisations if everybody's right to the protection of personal data and private life is respected. Anonymisation – which results from processing personal data in order to prevent identification irreversibly – may be a good strategy to keep the benefits of publication while mitigating the risks of identification.
Anonymised data do not fall under the scope of data protection rules, but data subjects may still be entitled to protection under other provisions (such as those protecting confidentiality of communications). In addition, the Opinion points out that the anonymisation process constitutes a further processing of personal data which, as such, must observe the data protection rules.
Case studies and research publications have shown how difficult it is to create a truly anonymous dataset whilst retaining as much of the underlying information as required for the task. Whether a given anonymisation technique can guarantee anonymisation is analysed on the basis of three risk factors:
( i) Singling out, i.e. the possibility to isolate some or all records which identify an individual in the dataset;
(ii) Linkability, i.e. the ability to link at least two records concerning the same data subject or a group of data subjects (either in the same database or in two different databases).
(iii) Inference, i.e. the possibility to deduce, with significant probability, the value of an attribute from the values of a set of other attributes.
The Opinion furthermore classifies the main anonymisation techniques:
(i) Randomisation techniques are techniques that alter the veracity of the data in order to remove the strong link between the data and the individual (e.g. noise addition, permutation and differential privacy);
(ii) Generalisation techniques which generalise or dilute the attributes of data subjects by modifying the scale or order of magnitude (e.g. aggregation or K-anonymity and L- diversity).
The Working Party also discusses pseudonymisation techniques, i.e. security measures consisting of replacing one attribute in a record by another (e.g. hashing and tokenisation). Since the natural person can still be identified indirectly, pseudonymisation will not result in an anonymous dataset.
The Working Party concludes that each anonymisation technique has its advantages and disadvantages, and provides that careful engineering on a case-by-case basis may result in a solution meeting the three criteria, which would be robust against identification performed by the most likely and reasonable means the data controller or any third party may employ. Data controllers must therefore adapt the application of an individual technique to the specific situation and apply a combination of those techniques as a way to enhance the robustness of the outcome, while taking into account the practical recommendations developed in the Opinion.
The full text of the Opinion can be consulted here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
