Updates to the PDPA Advisory Guidelines on Anonymisation

Serious possibility vs. less than serious possibility

In this Guideline, the PDPC has clarified that the standard to be applied in considering whether personal data has been anonymised is whether there is a serious possibility that an individual could be re-identified. In applying this standard, the PDPC will consider the following factors in assessing the risks of re-identification:

1. whether the data itself, or combined with other information to which the organisation has or is likely to have access will result in re-identification; and
2. the measures and safeguards implemented by the organisation to mitigate the risk of identification.

For highly sensitive personal data, the PDPC has set a higher bar in that it requires an organisation to consider whether it would be appropriate to use or disclosure such anonymised data, even if there is a less than serious possibility of an individual being identified from that data.

Assessing the risks of re-identification

The revised Guidelines also introduced several additional factors for an organisation to consider when determining if there is a serious possibility that an individual can be re-identified. These factors are:

1. the nature of use and extent of disclosure of anonymised data (e.g. internal vs. public disclosure);
2. the public and personal knowledge available to the recipients that may enable re-identification;
3. the risks involved when disclosing multiple datasets; and
4. the current state of technology as well as the possible technological developments occurring over the data retention period.

Managing the risks of re-identification

Organisations should implement controls to limit access to other information that could enable re-identification. These controls need not always involve technically sophisticated anonymisation technology and include common sense methods such as adopting:

1. organisational structures;
2. legally binding agreements, administrative rules, or policies;
3. technical measures; and/or
4. physical measures,

that limit access to information.

Additionally, the PDPC considers that it may be appropriate for an organisation to consider engaging external experts to aid risk management, especially for complex anonymisation issues. Ultimately, the PDPC will take a holistic view in assessing the risk of re-identification, with regard to the relevant facts of the case.

Use, collection or disclosure of re-identified data

The PDPC has clarified that any unintentional re-identification by an organisation is generally not considered as collection of personal data, which requires the individual's consent. However, if the organisation subsequently uses or discloses such re-identified personal data, its actions would constitute use or disclosure of personal data.