3 ms·
> Also all data that might be deanonymized by some means is personal data. One question I've always had with this is whether it counts as personal data if it c
by pc86 4y ago
> Also all data that might be deanonymized by some means is personal data.
One question I've always had with this is whether it counts as personal data if it can only be de-anonymized by combining it with other data. So Company A manages some subset of a person's data.Company B manages a different subset (different app or whatever). Individually it is completely anonymous but if you combine them, it's trivial to de-anonymize.
Is this covered by GDPR? Both companies? What if one company dissolves and that data set is deleted?
Obviously a contrived example but an interesting thought experiment, I think.
- riedel 4y agoAs far as I understand data can only become anonymous as soon as the part that can lead to reidentification is actually deleted. We have such a case with the release of an 'anonymized' dataset , where the original data or the reidentifying set still exists. As far as I heard the opinions of the DPOs involved, the original data needs to get deleted for the data to be actually anonymous (although the data in the wild will not change). The problem is that otherwise th GDPR would have no effect anymore and the controller could 'anonymize' sensitive information and only keep uncritical identifying information. The other question on what basis of article 6 such processing would be allowed, as also the anonymization proceedure would probably count as processing. However, I have also heard theopinion of DPOs that you do not have to care as a receiver/user about the effectiveness of the anonymization, while other experts clearly state that there is a risk of becoming a controler if you cannot trace the effectiveness of anonymization and even the legal basis for that back to the origin.