Companies often want to keep using data without affecting individual people, for example for statistics, product improvements, or training AI models. Anonymization makes this possible: if data can no longer be linked to any person, the GDPR no longer applies to it.
The bar is high, however. According to the recitals of the GDPR, you must take into account all means reasonably likely to be used to identify a person, considering cost, time, and available technology. Whether data is anonymous is therefore not a permanent property. It must be reassessed when new techniques or additional data sources emerge.
How does anonymization work?
Deleting names is usually not enough. Common methods include:
- Aggregation: Only totals or averages across sufficiently large groups are reported.
- Generalization: Precise values are coarsened, for example a date of birth into an age group or an address into a region.
- Suppression: Rare values, outliers, and small groups are removed.
- Randomization: Values are deliberately given statistical noise, for example following the concept of differential privacy.
A well-known quality criterion is k-anonymity: each record should be indistinguishable from at least k-1 other records in its identifying attributes.
Typical examples
- A company analyzes support requests by category and month, without reference to individual people.
- Results of an employee survey are only shown for groups above a defined minimum size.
- After a retention period expires, data is anonymized instead of deleted to continue long-term statistics. Whether this is equivalent to deletion in a given case must be checked carefully.
What companies should keep in mind
- Assess the risk of re-identification, especially through linking with other data sources.
- Review free text, metadata, images, and voice recordings with particular care, since they are hard to anonymize.
- Keep in mind that, according to the prevailing view, anonymizing data is itself processing of personal data and requires a legal basis.
- Document the method and rationale, and review them at intervals.
- When in doubt, assume the data is pseudonymized and continue to apply the GDPR.
How it differs
With pseudonymization, data can still be linked to individuals using separately stored information, so the data remains personal data. Anonymization, by contrast, is intended to be permanent and irreversible. When data is passed on as training data or for analysis, this distinction determines which obligations apply.
This entry is a general overview and does not replace legal advice.