Options for Anonymising Personal Data under the General Data Protection Regulation

Handling personal data is a problem in two dimensions at once, technical and legal, and the two rarely align neatly. High-profile incidents at multinational companies had already shown how much reputational damage careless data handling can cause. The General Data Protection Regulation raised the stakes considerably: stricter requirements, and penalties severe enough to turn an organisational shortcoming into a financial one.

This paper works through what anonymisation offers in that context. Pseudonymisation and full anonymisation are both routes to processing data lawfully, but they are not equivalent, and the difference matters once a regulator is asking questions.

Two words that are not synonyms

Everything downstream depends on a distinction that ordinary usage blurs.

Pseudonymisation replaces the name and other identifying features with a label, for the purpose of precluding the identification of the data subject or making it substantially harder. Anonymisation is a stronger claim: altering the data such that individual details about personal or factual circumstances can no longer be attributed to an identified or identifiable natural person, or only with a disproportionate expenditure of time, cost and effort.

The gap between those two definitions is the whole subject. One conceals a link that still exists. The other destroys it.

The distinction, worked through

The paper illustrates both with the same starting table: a list of exam candidates carrying a name, a matriculation number, a grade and an attached PDF of the script.

Name	Matriculation no.	Grade	Script
Müller, Tom	7093821	2.0	LösungMueller.pdf
Meier, Stefan	7091284	1.3	LösungMeier.pdf
Schmidt, Alex	7095986	3.0	LösungSchmidt.pdf

Pseudonymisation splits that into two, and the split is along the lines of who is allowed to know what. The marker receives a list keyed by a neutral running number, carrying the grade and a script stripped of anything identifying its author. The examinations office holds the other half, which maps each number back to a name.

The separation is what constitutes the pseudonymisation. Recombining the two tables restores the attribution completely, which is precisely why the halves must be held apart.

Anonymisation instead rewrites the identifying values irreversibly, hashing the name, the matriculation number and the identifiers inside the PDF alike. Where a sound encryption method is used, both the decryption and any later linkage of decrypted identifiers count as hard in the sense of complexity theory, which is to say not solvable in polynomial time.

What the regulation demands

Article 5 sets out the principles, and the paper reduces them to six: processing must be intelligible to the data subject, bound to a specified and legitimate purpose, minimised to what that purpose requires, factually accurate and kept current, stored in a form allowing identification only as long as the purpose needs, and secured against unauthorised or unlawful processing.

Where it becomes difficult

The central observation is that the underlying problem is less a technical one than a financial and practical one, and that the direction of travel in the industry runs against the regulation. The prevailing move towards machine learning, and the appetite for big data methods that comes with it, sits in direct contradiction to the principles of data minimisation and purpose limitation. Collecting less is not what these methods reward.

Two obligations are singled out as particularly awkward in practice. The right of access and erasure extends further than most organisations assume, reaching printed output and data already passed to third parties under processing agreements, which in a group with complex processing chains produces conflicts that are barely resolvable and can threaten an existing business model outright. The accountability obligation requires an organisation to demonstrate compliance on its own initiative, and in a functionally organised company with any tendency towards departmental self-interest, assembling a legally sound account of one customer’s processing across the whole business is genuinely hard.

The paper then sorts likely situations into four scenarios along two axes, whether the data were already held or collected for the occasion, and whether the intended use is general or specific.

	Already collected	Collected for the purpose
General use	Scenario 1	Scenario 3
Specific use	Scenario 2	Scenario 4

Scenarios 1 and 2 are the problematic pair. Operating on existing processing agreements is possible in principle, but those agreements are now read more strictly than they were, and the likelihood that an already-concluded agreement informed the user adequately about the rights and the concrete purposes is slim. Consent has to be sought again. Scenarios 3 and 4 are more tractable, since the agreements can be adapted directly and only data from people who genuinely consented in full are in play.

Deletion as an architectural problem

Consent can be withdrawn at any time, which means an organisation needs deletion that is complete and documented rather than merely attempted. The paper treats this as a question of data architecture rather than of policy.

The technical route is strict use of a single central database underneath every application, with redundant storage at project level forbidden, so that deleting the central record propagates everywhere by construction. The alternative is a central process layer holding access to all relevant datasets, which is more complex. Retrofitting central structures into an estate that already has its own is unwieldy and technically demanding, which is why that route suits organisations with genuinely distributed data, such as multinational groups.

For most realistic cases the paper recommends a dual approach: a central process solution for deleting data that already exists, alongside a central database for everything created from now on.

Conclusion

Anonymisation and pseudonymisation are judged an excellent means of securing personal data to the current state of the art, with the qualification stated plainly: they are one small step in a company-wide process of data avoidance, not a substitute for one. Additional encryption and automated, time-controlled deletion are needed alongside them to satisfy the right to be forgotten.

That burden falls unevenly. For small and medium-sized companies it is a hurdle that is currently hard to clear, because it presupposes highly specialised expertise on both the technical and the legal side at once.

The sharpest point is saved for the standard itself. Data count as anonymised only once re-identification is difficult, and the legal threshold for that is often set too high to be meaningful. The trend towards machine learning and the steadily improving usability of big data raise the chances of re-identifying supposedly anonymous data, which erodes the guarantee from underneath while the definition stays where it is.

Data are the capital of a twenty-first century company, and the regulation is the first European-wide standard governing how that capital may be handled. Verifying compliance against guidelines this extensive remains difficult, which is why the politics of data use stay opaque.

Abstract

Processing personal data is a current topic both technically and legally. Recent high-profile incidents at multinational corporations have demonstrated the reputational damage that negligent handling of data can cause. With the stricter requirements of the General Data Protection Regulation and considerably higher penalties in the event of a breach, the financial risk arising from technically and organisationally inadequate handling of personal data becomes more concrete still. Options for anonymising data, such as pseudonymisation or full anonymisation, represent a legally sound means of ensuring the secure onward processing of data in light of the General Data Protection Regulation.

@techreport{golombeck2018anonymisierung,
  author      = {Golombeck, Marius and Orlowski, Henning},
  title       = {{Anonymisierungsmöglichkeiten personenbezogener Daten vor dem
                 Hintergrund der Datenschutzgrundverordnung}},
  institution = {University of Applied Sciences and Arts Dortmund},
  address     = {Dortmund, Germany},
  year        = {2018},
  month       = may,
  language    = {german},
  doi         = {10.13140/RG.2.2.16151.83362},
  url         = {https://www.researchgate.net/publication/330162667}
}