1. Amandine Jambert - IT Experts Department
WP29 & CNIL POINT OF VIEW
ON ANONYMISATION
CESS 2016
20/10/2016
Amandine Jambert - IT Experts Department

2. Amandine Jambert - IT Experts Department
Cnil
Cnil – French Data Protection Authority
Independent Administrative Authority
Main missions:
Informing & Educating
Protecting the Rights of Citizens
Regulating & Advising
Accompanying the Conformity
Anticipating Innovation
Inspecting and Sanctioning
20/10/2016
Amandine Jambert - IT Experts Department

3. Amandine Jambert - IT Experts Department
WP29
WP29 (Article 29 Working Party):
advisory status and acts independently
composed of :
1 representative of the EDPS
1 for each EU Data Protection Authority
1 for the European Commission.
20/10/2016
Amandine Jambert - IT Experts Department

4. Amandine Jambert - IT Experts Department
PERSONAL DATA AND ANONYMOUS DATA: DEFINITIONS
Part 1
20/10/2016
Amandine Jambert - IT Experts Department

5. ‘Personal data’ in the EU law
DIRECTIVE 95/46/EC
GDPR (General Data Protection Regulation)
Recital (26)
(…) whereas, to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person;(…)
Article 2:
'personal data' shall mean any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
Article 4 :
(1) 'data subject' means an identified natural person or a natural person who can be identified, directly or indirectly, by means reasonably likely to be used by the controller or by any other natural or legal person, in particular by reference to an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person;
(2) 'personal data' means any information relating to a data subject;
20/10/2016
Amandine Jambert - IT Experts Department

6. Amandine Jambert - IT Experts Department
‘Personal data ’ sum up
A data is a personal data if:
It is related to an identified or identifiable individual
Identification can be :
direct or indirect
by the controller or by any other person
20/10/2016
Amandine Jambert - IT Experts Department
CNIL

7. ‘Anonymous data’ in the EU law
DIRECTIVE 95/46/EC
GDPR (General Data Protection Regulation)
Recital (26)
(…) the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable;
Recital (23)
(…) The principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable. (…)
20/10/2016
Amandine Jambert - IT Experts Department

8. ‘Anonymous data ’ sum up
A data is anonymous data if:
it is not related to an identified or identifiable individual
= it is not a personal data
Personal data
Anonymous data
Privacy law applicable
Privacy law not applicable
20/10/2016
Amandine Jambert - IT Experts Department
CNIL

9. Amandine Jambert - IT Experts Department
WP29 OPINION & CRITERIA FOR ANONYMOUS DATA
Part 2
20/10/2016
Amandine Jambert - IT Experts Department

10. WP29 opinion on Anonymization
Pseudonymous ≠ anonymous.
Two options to check if a dataset is anonymous:
reidentification risks are negligeable or null
OR it has none of the 3 following properties:
possibility to single out an individual (‘singling out’)
ability to link records of an individual (‘linkability’)
possibility to infer* new information on a person (‘inference’).
* with overwhelming probability
20/10/2016
Amandine Jambert - IT Experts Department
CNIL

11. Evaluation of main techniques
Is singling out still a risk ?
Is linkability still a risk ?
Is inference still a risk?
Pseudonymisation
Yes
Noise addition
May not
Substitution
Aggregation or
K-anonymity No
L-diversity
Hashing/
Tokenization
No single technique eliminates all risks
20/10/2016
Amandine Jambert - IT Experts Department

12. DPA’s recommandations
Prior to anonymization:
Specify the planned use of the anonymized dataset
Distinguish key attributes from non-critical pieces of information
Remove identifiers and infrequent values
Find a tailored solution
Combine anonymization techniques
Document choices
Assess the re-identification risk and have your assessment validated
Afterwards:
Publish your anonymization techniques and have them reviewed
Follow development of anonymization and re-identification techniques
20/10/2016
Amandine Jambert - IT Experts Department

13. Amandine Jambert - IT Experts Department
Thank you
20/10/2016
Amandine Jambert - IT Experts Department
CNIL