Pseudonymisation or anonymisation

Two related notions, two regimes

• Anonymisation

  The person can no longer be identified, by anyone, including by cross-referencing the document with other information. It is a demanding standard: the CNIL and its European counterparts consider it hard to achieve. Truly anonymous data falls outside the scope of the GDPR.

• Pseudonymisation

  The person can no longer be identified without additional information, kept separately (Article 4 of the GDPR). A pseudonymised document is still a document that contains personal data: the GDPR continues to apply.

What Klarmask does

Klarmask redacts (it removes from the file what you decide to redact) and pseudonymises (it replaces each item with a stable label, “[Person A]”). It cannot promise anonymisation: it does not know what the reader of the document already knows.

It does, however, remove what a poor redaction leaves behind: the text under the rectangle, metadata, comments, earlier versions. That is the starting condition for any sharing, not its end point.

What gives a person away when their name is redacted

• A job title: “the finance director of the Lyon subsidiary” refers to one person only.
• A date and a place: an accident on a given date, in a given town.
• A rare detail: an illness, an occupation, a number of children.
• Style: a letter recognisable by the way it is written.
• Cross-referencing: the same document published elsewhere, a press article, a social network.

Reread before sharing

1. Reread as someone close would

   Would someone who knows the case, the department or the family recognise the person?

2. Redact what identifies

   Job titles, exact dates, places, rare details: “Redact everywhere” works for them too.

3. Keep the table separately

   If you pseudonymise so that you can re-identify later, the mapping between labels and people is the GDPR's additional information: keep it separately, and protect it.