DPC Guidance On Anonymisation – Techniques And Data Protection Obligations

The Data Protection Commissioner ("DPC") recently published guidance on the use of data anonymisation and pseudonymisation techniques. In our last blog, we examined these concepts and some of the key points in the DPC's guidance. We focused, in particular, on the difficulties in implementing these techniques and the scope of what is considered to be personal data.

We take a closer look at some of the anonymisation techniques referenced in the DPC's guidance. We also consider data protection law obligations arising for organisations wishing to anonymise or pseudonymise certain data sets.

Anonymisation Techniques

The Data Protection Acts 1988 and 2003 (the "Acts") do not explicitly recognise the concepts of data anonymisation and pseudonymisation, meaning there is no prescriptive standard of anonymisation under Irish law. Consequently, an organisation hoping to employ anonymisation techniques will have to decide, on a case-by-case basis, what techniques to use