New directions for data governance in health data? Examining the role of anonymisation and pseudonymisation

Abstract

Data governance can be considered a commonly shared priority for many organisations. This paper examines the roles of anonymisation and pseudonymisation as privacy-enhancing technologies (‘PETs’) as part of data governance focusing on the health and medical sector. Ultimately, it asks whether organisations should reframe their data governance to favour anonymisation or pseudonymisation respectively. To that, the paper concludes that while both anonymisation and pseudonymisation appear important technical tools, they ought to be understood as part of the wider frame of data governance, where no stand-alone tool seems to suffice. Rather, a wider outlook that also includes organisational and legal measures is needed. Regarding the latter, the guidance seems to proliferate, and in those, reasonable protective measures, along with risk-based approaches, appear common.