Real-World Data Protection Questions

So my first question for you guys is, when is data really anonymous and how easy is it to lose that status?

Anonymisation sounds simple, doesn't it, Rach?

Yeah,

yeah.

And people think it's just such an easy thing to do.

You just take something out, right? And then suddenly...

It's anonymous.

If you take someone's name out, then you can't possibly identify

someone if you've removed the name, can you? No, but it can be a mix of data that if it's combined together, then just because of their name, job title and location can identify someone, especially if you're in like a small team and there's only one person with that job title and people will instantly know who they are.

And so if you blend data together, then it can be really easy to identify somebody.

I think the issue

as well is that what is personal data? Because people think just taking a name out, that means you've taken the personal data away.

So you can't possibly identify someone.

But actually, personal data is so much more than that, isn't it, Amy? So it's like so many different factors.

You know, we could talk on this call about, you know, the person I want to identify has blonde hair or brown hair.

And suddenly you've identified the person just from that characteristic.

You don't have to say whether they're male or female.

And so it's all about a number of different factors that together may not say anyone's name, date of birth, telephone number or email address, but you could identify who we're talking about from a descriptor like how tall they are, whether they're male or female, whether they've got brown or blonde hair, whether they've got curly or straight hair, whether they wear glasses or they don't.

So, you know, what is personal data? Because that comes back to how easy it is to anonymize something.

And, you know, obviously one of the big things to understand as well is around the re-identification of somebody, because this is happening quite a bit, certainly with some of our clients where we may redact documentation for them and they'll read through it to proofread and they go, oh, well, we can still tell you that is because we know all of this as well already within the business.

So this is around putting your different data sets back together again to re-identify someone.

So it can become quite difficult to actually completely anonymize something Because you don't know what someone else already knows and how they are potentially able to re-identify.

And the most important thing to know about re-identification is that it's actually an offence under Section 171 of the Data Protection Act.

And it used to be the old Section 56 of the old Data Protection Act.

So it's always been a problem to re-identify someone.