ICO launches consultation on draft guidance regarding anonymisation and pseudonymisation for research purposes

The Draft Guidance explains that under the UK GDPR there are four recognised RAS purposes for processing personal data: 

• Archiving purposes in the public interest 
• Scientific research purposes 
• Historical research purposes 
• Statistical purposes 

In each case, personal data may only be processed for RAS purposes if: 

• the processing comprises the collection of personal data 
• the processing is carried out in order to convert the personal data into data which cannot identify the data subject or
• without the processing, the RAS purposes cannot be fulfilled. 

If personal data is processed for RAS purposes, appropriate safeguards must be applied to protect the rights and freedoms of the data subjects.

Key areas addressed by the draft guidance

Anonymous data, pseudonymous data and the data protection role

The Draft Guidance reminds organisations of the distinction between anonymous and pseudonymous data. It provides a decision tree to help determine whether an organisation can fulfil its research purposes using anonymous data or whether pseudonymous data would be appropriate for those purposes.

Consistent with the general ICO guidance on anonymisation (to be read alongside this more specific guidance), the Draft Guidance sets out the benefits of using anonymisation (including reducing the data protection compliance burden and engendering trust). It also highlights some benefits of pseudonymous data (including demonstrating appropriate safeguards, supporting longer retention periods and enabling reliance on certain exemptions from data subject rights).

In the context of RAS processing, the Draft Guidance recognises the potentially complex ecosystem of organisations involved. With a view to understanding compliance obligations and assessing identifiability of data, the Draft Guidance highlights the need to carefully determine an organisation’s data protection role (controller, processor, joint controller, no data protection role).

Technical and organisational measures as appropriate safeguards

A significant proportion of the Draft Guidance considers what technical and organisational measures constitute “appropriate safeguards” in the context of processing for RAS purposes. The Draft Guidance acknowledges that this will vary depending on the nature of processing but suggests that a combination of measures may be proportionate and that organisations:

• must address the principle of data minimisation
• must take a “data protection by design and default” approach
• must implement appropriate security measures
• must (where necessary) carry out a DPIA and appoint a data protection officer
• should provide appropriate levels of training
• could use privacy-enhancing technologies (PETs) and
• could use accountability frameworks such as the Five Safes framework (a set of principles that enable data services to provide safe research access to data).

Data sharing

The Draft Guidance also provides information on the sharing of anonymised and pseudonymised data, the need to consider identifiability in new hands and approaches that could help mitigate the risk of reidentification (including limiting recipients, using trusted research environments (TREs) and PETs).

Data minimisation

If it is not possible to achieve the relevant RAS purpose using anonymised data, the Draft Guidance recognises that personal data can be used. However, the data minimisation principle must be met (removing direct and indirect identifiers where possible).

The Draft Guidance states that an organisation must remove personal data that is not required and must be able to explain why it is strictly necessary and proportionate to use the remaining personal data for the RAS purpose. The Draft Guidance highlights the limitations of relying solely on machine learning tools to remove identifiers and considers specific scenarios such as minimisation in speech, video and sensor data.

The Draft Guidance goes into detail on the use of Trusted Research Environments, Trusted Third Parties and federated approaches to data access and sharing.

Synthetic data

Finally, the Draft Guidance explains what synthetic data is, when it is appropriate to use it in the context of RAS purposes and what to consider when doing so (including the identifiability of source data, patterns between data variables of data, the potential to draw inferences from the synthetic data and whether anyone has the means (or motivation) to identify an individual from the synthetic data). Among other matters, the Draft Guidance discusses the relevance of synthetic data to AI and its development.

Further reading

• The ICO public consultation
• The Draft Guidance