Art. 4(5). Pseudonymisation

Abstract

Art. 4(5) introduces the concept of “pseudonymisation”, which consists in processing personal data in such a way as to restrict the possibility of attributing such data to the data subjects concerned. Pseudonymisation transforms a set of personal data into a new set of data — the pseudonymised data — which can be attributed to the data subjects only through the use of further data, that are kept separately and are subject to technical and organisational measures to prevent their unauthorised or unlawful use. Pseudonymisation must be clearly distinguished from anonymisation. Anonymised data no longer qualify as personal data, since they can no longer be linked to the data subjects; therefore, they do not fall within the scope of the GDPR. On the contrary, pseudonymised data can still be linked to the data subjects (by using the further data that enable reidentification); therefore, they remain personal data, subject to the GDPR’s requirements. The use of pseudonymisation measures is not explicitly mandated by EU data protection law, but practical considerations mean that pseudonymisation is likely to play a role in most data protection endeavours, and be practically unavoidable in those in which controllers are expected to uphold an especially high level of protection.