ADR UK responds to the Information Commissioner’s Office call for views: Anonymisation, pseudonymisation and privacy enhancing technologies guidance

The ADR UK partnership has responded to the Information Commissioner’s Office (ICO) ‘Call for views: Anonymisation, pseudonymisation and privacy enhancing technologies guidance’.

ADR UK has responded to first chapter of the guidance, ‘Introduction to Anonymisation’ which outlined a range of legal, policy and governance issues around the application of anonymisation in the context of data protection law.

We commented on the aspects of the guidance that were most relevant to us on topics such as anonymisation, de-identification and pseudonymisation. Our response emphasised a few key points:

1. Anonymisation is a complex issue that may not always be appropriate or possible. The guidance should draw out the factors that need to be considered when making this decision, such as the data may be less useful once anonymised and that organisations need to have sufficient skills, resources, technology, and processes in place.
2. Pseudonymised data, with the right controls in place, should be considered functionally anonymised. For example, data held in a Digital Economy Act (DEA) -accredited trusted research environment with controls over use and user. 
3. De-identified information is a better term to use than anonymous, as it acknowledges it is extremely difficult to truly anonymise information while still retaining value and meaning to statisticians and researchers. This also increases transparency around data processing with the public, which may improve their trust in administrative data research.
4. How does this guidance relate to, update and modify other guidance, such as the DEA? 

We have also requested clarity on a number of points in the guidance, such as what ‘reasonably available means’ to re-identify individuals, and how to assess identification risk.

Overall, we welcome the ICO engaging with this agenda as it is of critical importance to the work of ADR UK. We hope that the next iteration of this guidance can go into more depth on the points noted.

Read ADR UK's full response.