The distinction between pseudonymised and anonymised data is one of the most consequential classifications in data protection law. Pseudonymised data remains personal data subject to the full GDPR (Art. 4(5), Recital 26). Anonymised data falls outside the GDPR entirely (Recital 26). The boundary between them determines whether processing requires a lawful basis, whether data subjects can exercise rights, and whether the data can be freely shared. This skill provides the analytical framework for making this determination, drawing on the CJEU Breyer ruling (C-582/14), the Article 29 Working Party Opinion 05/2014 on Anonymisation Techniques (WP216), and the ICO motivated intruder test.
Legal Definitions
Pseudonymisation — Art. 4(5)
"The processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person."
Key characteristics:
Data has undergone a transformation (tokenisation, hashing, encryption)
A re-identification key or method exists
The key is kept separately from the data
Technical and organisational controls protect the key
The data REMAINS personal data under GDPR
Anonymisation — Recital 26
"The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable."
Key characteristics:
No means exist that are reasonably likely to be used for identification
Assessment considers ALL means reasonably likely, including third-party means
Assessment accounts for cost, time, and available technology
Assessment considers technological developments over the data retention period
Truly anonymised data is NOT personal data — GDPR does not apply
The Three-Criteria Test — WP29 Opinion 05/2014 (WP216)
The Article 29 Working Party established three criteria for evaluating whether anonymisation is effective. Data is NOT anonymised if ANY of the three attacks can succeed:
Criterion 1: Singling Out
Definition: The possibility of isolating some or all records that identify an individual in the dataset.
Test: Can a specific individual be distinguished from all other individuals in the dataset?
Examples of failure:
A dataset with unique combinations of age, postcode, and gender that correspond to only one person in the population
A dataset with unique transaction patterns that correspond to a single customer
Removing a name but retaining a rare medical condition in a small geographic area
Mitigation techniques: k-anonymity (ensure at least k individuals share each combination of quasi-identifiers), aggregation to sufficiently large groups
Criterion 2: Linkability
Definition: The ability to link at least two records concerning the same data subject or a group of data subjects, either within the same dataset or between two separate datasets.
Test: Can records be combined across datasets to build a profile of an individual?
Examples of failure:
A hashed email address that can be matched across two datasets released by the same controller
A dataset with date of birth, postcode, and hospital visit date that can be linked to public voter registration records
Transaction patterns that can be matched with social media activity timestamps
Definition: The possibility of deducing, with significant probability, the value of an attribute from the values of a set of other attributes.
Test: Can sensitive information about an individual be inferred from the released data?
Examples of failure:
A dataset shows that all patients in a particular age-postcode group have the same diagnosis
Salary data for a small department where only one person holds a particular role
Aggregate statistics with small cell sizes that reveal individual values
Mitigation techniques: t-closeness (ensure attribute value distribution in each equivalence class is close to the overall distribution), differential privacy, cell suppression for small groups
Assessment Matrix
Criterion
Passes?
Overall Anonymisation Status
Singling out: NOT possible
Linkability: NOT possible
Inference: NOT possible → ANONYMISED
Singling out: possible
Any
Any → NOT anonymised (personal data)
Any
Linkability: possible
Any → NOT anonymised (personal data)
Any
Any
Inference: possible → NOT anonymised (personal data)
All three criteria must be satisfied for data to qualify as anonymised.
The Motivated Intruder Test (ICO)
The ICO supplements the WP29 framework with the "motivated intruder" test:
The motivated intruder is:
A person who starts without any prior knowledge of the data subject
Has access to the dataset and to publicly available resources (internet, public registers, social media, published statistics)
Has reasonable competence and motivation to re-identify (not a specialist)
Does NOT have access to specialist equipment, techniques, or insider knowledge
Would invest reasonable time and effort (days, not months)
If the motivated intruder could re-identify any individual: the data is NOT anonymised.
This test provides a practical complement to the WP29 criteria by establishing a baseline attacker model for the "reasonably likely means" assessment under Recital 26.
Data has undergone a de-identification process
│
├─► Step 1: Does a re-identification key exist?
│ YES → PSEUDONYMISED (personal data, GDPR applies)
│ NO → Continue to Step 2
│
├─► Step 2: Apply WP29 Three-Criteria Test
│ 2a. Singling out test — can any individual be isolated?
│ 2b. Linkability test — can records be linked to an individual?
│ 2c. Inference test — can attributes be inferred for an individual?
│
│ ANY test fails → NOT anonymised (personal data, GDPR applies)
│ ALL tests pass → Continue to Step 3
│
├─► Step 3: Apply Motivated Intruder Test (ICO)
│ Could a motivated person with public resources re-identify anyone?
│ YES → NOT anonymised
│ NO → Continue to Step 4
│
├─► Step 4: Breyer Relative Assessment
│ Does the specific data controller have legal means to obtain
│ complementary data enabling identification? (per C-582/14)
│ YES → NOT anonymised FOR THIS CONTROLLER
│ NO → Continue to Step 5
│
└─► Step 5: Technology Projection
Over the intended retention period, are technological developments
reasonably anticipated that would enable re-identification?
YES → NOT anonymised (or must be re-assessed before technology matures)
NO → ANONYMISED — GDPR does not apply
CLASSIFICATION: ANONYMISED
Document: technique used, assessment reasoning, review date,
assessor, technology projection horizon
CJEU Case C-413/23 — European Data Protection Supervisor v Single Resolution Board (Pending)
In 2023, the CJEU was asked to rule on whether pseudonymised data transmitted to a recipient who does not have the re-identification key constitutes personal data for that recipient. Advocate General Szpunar's opinion (September 2024) suggested a relative approach — if the recipient cannot reasonably re-identify, the data may not be personal data for them. This case, when decided, may significantly impact the pseudonymisation vs anonymisation boundary by establishing that the same dataset can be pseudonymised (personal data) for the data holder and effectively anonymous for a recipient without the key.
Implementation at Vanguard Financial Services
Common Pseudonymisation Scenarios
Scenario
Technique
Classification
Reasoning
Customer analytics dataset with account IDs replaced by random tokens
Tokenisation
PSEUDONYMISED
Vanguard holds the token-to-account mapping table
Employee survey responses with employee IDs removed but department and role retained
Attribute suppression + quasi-identifiers remain
PSEUDONYMISED (likely)
Unique department-role combinations may enable singling out for small departments
Aggregated website traffic statistics: page views by week, no user identifiers
Aggregation
ANONYMISED (if cell sizes adequate)
No individual can be singled out from aggregate page view counts with >1000 visitors per cell
Hashed customer emails for analytics
Hashing (SHA-256)
PSEUDONYMISED
Hash can be reversed via dictionary attack or rainbow table; same email always produces same hash, enabling linkage
Anonymisation Validation Process
Before classifying data as anonymised, Vanguard requires:
Written anonymisation assessment documenting technique applied and WP29 three-criteria evaluation
Motivated intruder test conducted by Privacy Engineering team
DPO review and sign-off
Annual reassessment (technology evolution check)
If data is shared externally: assessment from recipient's perspective (Breyer relative approach)
Enforcement Precedents
Breyer v Bundesrepublik Deutschland (CJEU C-582/14, 2016): Established relative approach to identifiability — central to distinguishing pseudonymised (identifiable) from anonymised (not identifiable) for a specific controller
CNIL — Practical Guide on Anonymisation (2019): CNIL rejected k-anonymity alone as sufficient for anonymisation, requiring assessment against all three WP29 criteria
Austrian DPA — 1&1 Telecom case (2019): EUR 9.55 million fine partly related to inadequate pseudonymisation measures — telephone customer service could identify callers with minimal verification, demonstrating pseudonymisation was ineffective
Integration Points
personal-data-test: Pseudonymised data is personal data; anonymised data is not — classification feeds the Art. 4(1) test
classification-policy: Pseudonymised data classified as Internal or Confidential; anonymised data classified as Public or Internal
ai-training-data-class: AI training datasets frequently use pseudonymisation; this skill validates whether the technique achieves true anonymisation
data-lineage-tracking: Lineage must track the anonymisation transformation and preserve the assessment record
