Anonymity and pseudonymity: First the issues, then the definitions

When anonymous data can, in many cases, be de-anonymised and when there is always some way to lift the veil of pseudonymity: Does that mean that anonymity and pseudonymity are just illusions? Do anonymous/pseudonymous data exist when such data relate to "identifiable" individuals?

There is only one answer to such questions (that I have been asked), the stereotypical lawyer's answer: It depends. Or, to be more precise: It depends on the definitions of the terms ("anonymity" and "pseudonymity"). And the definitions are necessarily man(or rather legislator)-made.

The Core Issues

It is anything but helpful and leads to circular arguments to start with presupposed definitions. Instead, it helps to remember what the core issues are when it comes to discussing anonymity and pseudonymity. Those issues are:

• Legislative Will: Should data protection laws encourage data processors to do without identifyers (names, addresses etc.)?
• Preference: Should there be incentives to use aliases instead of names and to use technologies anonymising data?
• Sliding Scales: If the processing of data that is anonymous/anoymised/pseudonymous/pseudonymised (on the difference between pseudonymity and pseudonymisation see (in German) Härting, "Was Pseudonymisierung von Pseudonymität unterscheidet", CRonline Blog v. 11.3.2013) is regarded as more privacy-friendly than the processing of data with straightforward identifiers, then what rules do we need for such "privacy-friendly" data and where do we draw the lines?

The answers could be:

• Incentives: Yes, there are more privacy risks when names, addresses and similar identifiers are used. Therefore, incentives for data processing that does without such identifiers makes perfect sense.
• Rules for Privacy-Friendly Data Processing: That does, however, not mean that "privacy-friendly" (= "less risky", see (in German) Härting, "Gute Nachrichten aus Brüssel: Vom Verbotsprinzip zur Risikoorientierung", CRonline Blog v. 7.3.2013) data processing can do without rules. There need to be law against de-anonymisation, and there need to be laws prescribing transparency.

The Crucial Turning Point

The toughest question is where to draw the line. What precisely constitutes "privacy-friendly" data processing for which a less restrictive set of rules applies. And this is the point at which we get to the definitions. Once we know where the line should be drawn, we can define the terms "anonymity" and "pseudonymity" to shape this line.