The concept of pseudonymization of personal data entered common usage with the GDPR (General Data Protection Regulation).
What is pseudonymization?
Pseudonymization consists in modifying personal data in such a way that it is impossible to identify whom it belongs to without access to additional information stored securely elsewhere.
An example of pseudonymization in online marketing is the User ID feature in Google Analytics. Each logged-in user is assigned an identifier in Google Analytics, which makes it possible to analyze individual users’ behavior. However, people with access only to Google Analytics are unable to determine who is behind these identifiers. Only access to the database (e.g. a CRM) makes it possible to associate these identifiers with specific people.
The widely used eCommerce tracking in Google Analytics also usually involves processing pseudonymized personal data. The transaction IDs visible in the panel don’t allow the identification of the people who made the transactions, but the store owner can easily look up in their own system the detailed data of the person behind a given transaction number.
Pseudonymization means de facto encryption with a more or less advanced key, access to which is protected from outsiders. Without that key, pseudonymized data is just a meaningless string of characters. As a rule, the pseudonymization process should be reversible — meaning that data which has been “encrypted” can be “decrypted” with the appropriate key.
Pseudonymization and data protection law
Bear in mind that under the GDPR, such pseudonymized personal data is still personal data within the meaning of data protection law. That’s why processing such data — and access to the systems that process it — may be subject to the relevant regulations, such as the GDPR or the rules connected with the ePrivacy regulation.
Pseudonymized personal data includes any identifiers that can potentially be linked to specific people — such as cookie identifiers or IP addresses — if in some other system they are linked to data that makes it possible to identify a person.
A set of device parameters (device make and model, operating system, browser and installed extensions, location (even approximate) etc.), which together may be unique for at least some users, also constitutes an identifier — a so-called fingerprint. That’s why identifiers are sometimes processed unintentionally, and these, again, may be considered personal data or fall under other privacy-protecting regulations.
Look at the example above once more. If a store sells many different products with various delivery cost options, practically every transaction has a different value. Combined with the date or time of purchase, the purchase price can constitute a unique identifier that may allow the controller (the store owner) to identify a person.
Such an identifier can constitute personal data even when it cannot currently be linked to an identifiable person, but such a link could potentially be made in the future (e.g. the moment the user provides their data to complete a transaction).
Pseudonymization vs anonymization
Pseudonymization should not be confused with anonymization, which consists in erasing or masking personal data. Anonymization may, for example, consist in replacing personal data with a fixed string (e.g. email=jan.kowalski@znana-poczta.pl is replaced with email=xxx-anonymized-xxx).
Data modified in this way ceases to be personal data, because nobody can link it to specific people anymore. Anonymization is an irreversible process — there is no key that could decrypt such data or otherwise reveal whom the anonymized data concerns.
We also recommend the article:
Personal data security in Google Analytics
