Pseudonymisation under the General Data Protection Regulation: A win-win approach?

Abstract

Under the European data protection regime, the pseudonymisation of personal data represents a prudent method of protection of personal data which tends to reduce the risk of compromising the rights of data subjects. The reduced level of the risk via this method (pseudonymisation) has resulted in a less strict regime of data protection regarding these data in Europe. Moreover, under most legal regimes beyond Europe, including the USA, pseudonymised data are not considered as personal data. Of course this does not necessarily mean that such data are not protected under these regimes. This paper will examine the legal nature of pseudonymisation through the definition and the principles related to processing of personal data in order to show if and to what extent there is a less strict regime regarding pseudonymised data. This regime could lead to a win-win approach in respect to both data controllers/processors and data subjects’ rights and interests.