{"id":173159,"date":"2022-08-01T06:52:21","date_gmt":"2022-08-01T05:52:21","guid":{"rendered":"https:\/\/legalvision.co.uk\/?p=173159"},"modified":"2022-08-09T01:21:42","modified_gmt":"2022-08-09T00:21:42","slug":"handle-pseudonymised-data","status":"publish","type":"post","link":"https:\/\/legalvision.co.uk\/data-privacy-it\/handle-pseudonymised-data\/","title":{"rendered":"How Your Business Should Handle Pseudonymised Data in England"},"content":{"rendered":"\n

Your business will create and store various forms of data, including pseudonymised data. Some businesses confuse this with anonymised data, but the Information Commissioner\u2019s Office<\/a> (ICO) treats the two types of information differently. It is essential your business handles this information according to the General Data Protection Regulation (GDPR) guidelines. The ICO investigates alleged breaches and can fine non-compliant businesses. This article will explain pseudonymised information, how it differs from anonymised data and how your company must handle it under the GDPR<\/a>.<\/p>\n\n\n\n

What is Pseudonymisation?<\/h2>\n\n\n\n

This is information that has had all identifying information removed or replaced. This makes the remaining data clean as to the original person\u2019s identity. For example, a straightforward method is to delete an individual\u2019s address or email address and replace the data subject’s name with \u2018Person 5\u2019  or \u2018#005\u2019 (or similar).<\/p>\n\n\n\n

Pseudonymised data is not truly anonymous. This is because your company will still possess the original data, so they can determine who \u2018Person 5\u2019 really is. Because of this, the GDPR defines pseudonymised information as personal data and places specific requirements on your company when processing it.<\/p>\n\n\n\n

An Example<\/h3>\n\n\n\n

Suppose your company has decided to carry out an optional equality survey in the workplace. The purpose is to learn about the workforce’s diversity and set a marker to improve in the future. The questions within the survey include ones relating to each person\u2019s age, ethnicity, religion and opinion on whether they feel your business encourages diversity and equality or not.<\/p>\n\n\n\n

If you have a relatively small workforce, it may be possible to identify individuals from their age and the data given, even if the survey does not record names. However, this would constitute pseudonymised data because, if you were motivated to do so, you could reverse engineer the identity of the majority of staff.<\/p>\n\n\n\n

\n

A proper pseudonymisation process will involve an individual at your organisation obtaining and presenting the information in a less identifiable manner.<\/p>\n<\/div>\n\n\n\n

For example, they could do so by:<\/p>\n\n\n\n