关于假名化的012025号指南_46页_1mb

Summary of Guidelines on Pseudonymisation

Core Content

The Guidelines on Pseudonymisation, adopted on 16 January 2025, provide a detailed framework for the application of pseudonymisation as a data protection measure under the GDPR. These guidelines aim to clarify the legal definition, objectives, and implementation of pseudonymisation, emphasizing its role in reducing risks to data subjects and meeting data protection obligations.

Main Viewpoints

• Definition of Pseudonymisation:
  Pseudonymisation is defined in Art. 4(5) GDPR as a processing method that makes personal data unattributable to a specific data subject without the use of additional information. This additional information must be kept separately and protected through technical and organisational measures.

• Objectives and Advantages:

  • Risk Reduction: Pseudonymisation reduces confidentiality risks and prevents unauthorized access or use of data.
  • Analysis and Linkage: It enables data analysis while allowing controlled linkage of records to specific individuals.
  • Function Creep Mitigation: It limits further processing of data in a way incompatible with the original purpose.
  • Accuracy Protection: By using different pseudonyms for similar data subjects, it can also reduce the risk of incorrect data attribution.

• Pseudonymisation Domain:
  The pseudonymisation domain refers to the defined context in which pseudonymised data is processed and the entities that may attempt to attribute it. It may include:

  • Internal organisational units.
  • Specific legitimate recipients.
  • Potential unauthorized third parties.
    The domain must be carefully defined to ensure that only authorized persons have access to the additional information needed for attribution.

• Legal Basis and Compliance:
  Pseudonymisation is not a mandatory requirement under GDPR, but it can be used as a supplementary measure to meet data protection obligations. It can serve as a basis for data protection by design and by default and help ensure a level of security appropriate to the risk. However, it must always be compliant with GDPR principles, including lawfulness, transparency, and confidentiality.

• Implementation Considerations:

  • Pseudonymised data must be processed separately from additional information.
  • Controllers must secure the pseudonymisation domain to prevent unauthorized attribution.
  • Technical and organisational measures are essential to protect pseudonymised data and ensure that it cannot be linked back to individuals without proper authorization.

• Rights of Data Subjects:
  Even when pseudonymised, data remains personal and thus the rights of data subjects (e.g., access, rectification, erasure) still apply. Controllers must ensure transparency and facilitate the exercise of these rights, unless an exception applies (e.g., Art. 11(2) and 12(2) GDPR).

• Unauthorised Reversal:
  If pseudonymisation is reversed without authorization, it may compromise the privacy of data subjects. Therefore, measures must be taken to prevent unauthorized reversal.

Key Information

• Pseudonymisation is not anonymous: Pseudonymised data is still considered personal data unless it meets the conditions for anonymity.
• Controller responsibility: Controllers must determine the objectives and effectiveness of pseudonymisation based on risk assessment and the nature of the data processing.
• Legal basis for processing: When pseudonymisation is used, the legal basis for processing may include legitimate interests (Art. 6(1)(f) GDPR) or other lawful bases.
• Supplementary measure: Pseudonymisation alone is not sufficient to meet all data protection requirements, but it can be used in conjunction with other measures to enhance data protection.

Conclusion

These guidelines provide practical steps for controllers and processors to implement pseudonymisation effectively, ensuring compliance with GDPR and protecting data subjects' rights. They emphasize the importance of defining the pseudonymisation domain, applying appropriate technical and organisational safeguards, and ensuring that pseudonymisation is effective in achieving the intended data protection objectives. The annex includes real-world examples that illustrate the application of pseudonymisation in various scenarios.

Key Sections Overview

These guidelines are essential for organizations seeking to implement pseudonymisation in a manner that is both effective and compliant with EU data protection law.