Pseudonymization
By Gareth HoyleLast updated How we research
Pseudonymization is processing personal data so it can no longer be linked to a specific person without additional information that is kept separately and secured.
Pseudonymization is the processing of personal information so that it is no longer attributable to a specific person without additional information, provided that information is kept separately and protected by technical and organizational measures. That is the CCPA definition at California Civil Code section 1798.140(aa). NIST describes it as a de-identification technique that replaces an identifier with a pseudonym.
Replacing names with ID codes and holding the key elsewhere is a common example.
Is pseudonymized data deidentified under US law?
Pseudonymized data is not deidentified under the CCPA unless it also meets the three conditions in section 1798.140(m): reasonable measures, a public commitment not to re-identify and contractual limits on recipients. HIPAA allows a re-identification code only if it is not derived from information about the person and the key is not disclosed, under 45 CFR 164.514(c).
In an AI data deal this means a seller who keeps the key still holds information that can be linked to people, while the buyer's position depends on what else it holds.
How does UK GDPR treat pseudonymization?
UK GDPR Article 4(5) uses almost the same wording, and the ICO says pseudonymized data stays personal data in the hands of anyone who holds the additional information.
See anonymization, re-identification risk and de-identification for AI training data.