Processing Anonymous Data – A Legal Update

Article by Nigel Wildish and Marcus Turle

It was generally assumed that data which did not identify individuals fell outside the scope of the Data Protection Act 1998. However, those responsible for handling such information may have to think again in the light of new guidelines on data protection issued by the UK’s Information Commissioner.

In this article, partner Nigel Wildish and assistant Marcus Turle, of the IT & E-commerce group at City law firm Field Fisher Waterhouse, consider the new approach and its implications for UK data processors.

Traditionally, data which are anonymous or have been "anonymised" have been viewed as exempted from the obligations which apply to the use of "personal data"¹. Those familiar with the Court of Appeal’s decision in the Source Informatics case² will be aware that this was the case even before the introduction of the Data Protection Act 1998 (the DPA).

However, in her new guidelines, the UK Information Commissioner³ now suggests that, in certain situations, the DPA will apply even where data being processed are anonymous.

In the Source Informatics case, the Court of Appeal considered whether or not the anonymisation of data and its disclosure fell within the scope of EU Directive 94/56/EC (at the time yet to be implemented in the UK but now incorporated into English law by the DPA) and held that it did not.

In 1997, Source Informatics Ltd launched a service to supply pharmaceutical companies with data indicating the prescribing patterns of GPs. To do this, it first had to obtain the raw data, which was then aggregated into a form which was valuable to Source’s customers.

The raw data was collated on pharmacists’ databases. They had extracted it from prescription forms completed by doctors which had then been handed over to pharmacists by patients. The pharmacists had added the data to their own databases and anonymised them using software which Source had provided. In this way, the information supplied no longer bore the risk of identifying any individuals.

The Department of Health advised health authorities that confidentiality obligations prohibited disclosure of this information, even though it was anonymous, unless consent had been given by the patient or doctor who had originally provided it. Source Informatics appealed against the guidance on the grounds that it was wrong in law. Although the application did not directly address data protection, the issue was addressed as part of the case.

In considering whether either disclosure or anonymisation of the data in question had breached the terms of the Directive, the Court of Appeal examined the Directive’s wording:

"Member states shall prohibit…the processing of data concerning health…"unless" the data subject has given his consent to the processing of those data…" or "the processing of the data is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services, and where those data are processed by a health professional [which the parties agreed included a pharmacist]."

Moreover, recital 26 of the Directive states that:

"the principles of protection shall not apply to data rendered anonymous in such a way that the data subject is no longer identifiable".

It continues: "Codes of conduct within the meaning of Article 27 [of the Directive] may be a [sic] useful instrument for providing guidance as to the ways in which data may be rendered anonymous". ."⁴

The Court concluded that:

"the Directive can have no more application to the operation of anonymising data than to the use or disclosure of anonymous data (which…by definition are not "personal data" and to which, therefore,…the Directive has no application)".

Relying on the wording in recital 26, it held that the process contemplated in the Source Informatics case probably fell outside the scope of the Directive.

The authors believe the DPA definition of "processing" should be read to include the process of anonymisation. The UK Commissioner’s latest data protection guidance has dedicated an entire section to the issue of the anonymisation of data. In it she says:

"In anonymising personal data the data controller will be processing such data and, in respect of such processing, will still need to comply with the provisions of the Act."

She adds:

"true anonymisation may be difficult to achieve in practice…because the data controller may retain the original data set from which the personal identifiers have been stripped to create the "anonymised" data. The fact that the data controller is in possession of this data set which, if linked to the data which have been stripped of all personal identifiers, will enable a living individual to be identified, means that all the data, including the data stripped of personal identifiers, remain personal data in the hands of the data controller and cannot be said to have been anonymised. The fact that the data controller may have no intention of linking these two data sets is immaterial."

If this is so, data contained in an anonymised database may still qualify as "personal data". If the data controller also has in his or her possession the pre-anonymised version, he or she could therefore effectively reverse-engineer the anonymised version using the original and, in doing so, identify its individual subjects.

By applying the above definition and the UK Commissioner’s comments, it appears that the pharmacists’ actions in the Source Informatics case would have been interpreted by a court as "processing" under the DPA.

It also seems more probable that the UK Commissioner would expect both the use of software to anonymise data and the anonymised data itself, if kept by the pharmacists, to be regulated.

If this is the case then, according to today’s guidelines, both the pharmacists’ use of the Source software and disclosure of the anonymised data to Source Informatics would have been in breach of the DPA, unless either the patients had given their consent, or another of the DPA Schedule 2 pre-conditions, or any exemptions under the Act, applied.

Judging from the wording quoted above from recital 26, it seems that the legislators who drew up the Data Protection Directive may have already been aware that such a problem might arise and had therefore intended that at least some anonymisation should remain legal.

During the process of anonymisation, there should be no disclosure of a data subject’s personal data to a third party. However, afterwards, there may be disclosure of data but it will no longer be "personal", providing the information has been properly anonymised and not juxtaposed with any other information which together may identify an individual.

One way to ensure this would be to introduce a code of practice which would allow data anonymisers to continue to operate on the condition that they did not harm or prejudice the rights, freedoms or legitimate interests of living individuals.

The authors believe that due consideration should also be given to Schedule 1, Part II and Section 33 of the DPA in relation to the anonymisation process.

Schedule 1, Part II could be applied in relation to the First Data Protection principle, according to which personal data shall be processed "fairly and lawfully".

"Lawful" processing presumably includes processing in accordance with the principles of the Source Informatics case in relation to confidential data.

"Fair" processing requires that data subjects are notified of certain information in relation to the processing of their data. However, there is an exception where "the provision of that information would involve a disproportionate effort".⁵ "Fair" processing also requires that one of the conditions in Schedule 2 are met which, in the case of personal data which are not sensitive, allows for processing where it is:

"necessary for the purposes of legitimate interests pursued by the data controller…except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject".⁶

The issue of exactly how anonymous data may be processed is not just a UK but an EU-wide issue. Data processors would be well advised to obtain legal guidance on the enabling legislation which applies to their jurisdiction and ensure that their activities are not in breach of it.

In the UK, practitioners should start by considering the "disproportionate effort" and "legitimate interests" exemptions to see if and how these can be applied to their clients’ businesses.

Meanwhile, the data protection commissioners could also help to clarify the situation by introducing comprehensive codes of practice for guidance as was originally envisaged by Directive 94/56/EC some time ago.