What is Pseudonymous data according to the GDPR?

Anonymisation and pseudonymisation are two key concepts for the General Data Protection Regulation (GDPR). The GDPR provides exceptions to many of the most burdensome provisions of the regulation when steps are taken to de-identify personal data using anoymisation or pseudonymisation.

What is pseudonymisation?

“[...] The processing of data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;” (art. 4(5) GDPR)

Data is pseudonymised or de-identified when it doesn’t contain explicit personal data, but only unique references to it. Pseudonymisation is a good security technique to make sensitive health data less explicit, but still linked to a physical subject and easy to manage.

However, under GDPR, pseudonymised data is still considered as sensitive data and it must be protected accordingly.

Pseudonymous data case study

In 2006, AOL, released a de-identified database containing 20 million search queries from over 650,000 users. This led to a huge privacy violation scandal, since search queries contained private information and “quasi-identifiers”, i.e. data like zip codes, gender and date of birth that, when combined, can reveal the identity of a specific person.

Practical suggestions

Using pseudonymisation to protect your data will reduce risks, but you still need to guarantee additional administrative and technical safeguards.

How Chino.io can help?

To implement pseudonymisation you must ensure that the sensitive data is stored in a secure place. Chino.io is the perfect solution for storing and encrypting health and personal data and our APIs make implementing pseudonymisation easy.