The GDPR and unstructured data: is anonymization possible?

Much of the legal and technical literature on data anonymization has focused on structured data such as tables. However, unstructured data such as text documents or images are far more common, and the legal requirements that must be fulfilled to properly anonymize such data formats remain unclear and underaddressed by the literature. In the absence of a definition of the term ‘anonymous data’ in the General Data Protection Regulation (GDPR), we examine its antithesis—personal data—and the identifiability test in Recital 26 GDPR to understand what conditions must be in place for the anonymization of unstructured data.

This article examines the two contrasting approaches for determining identifiability that are prevalent today: (i) the risk-based approach and (ii) the strict approach in the Article 29 Working Party’s Opinion on Anonymization Techniques (WP 216). Through two case studies, we illustrate the challenges encountered when trying to anonymize unstructured datasets. We show that, while the risk-based approach offers a more nuanced test consistent with the purposes of the GDPR, the strict approach of WP 216 makes anonymization of unstructured data virtually impossible as long as the original data continues to exist.

The concluding section considers the policy implications of the strict approach and technological developments that assist identification, and proposes a way forward. Big data is often characterized by its four constitutive ‘Vs’: digital data is produced in increasingly larger amounts (Volume), at high speed (Velocity), with a broad range of data types (Variety), and with differing levels of quality (Veracity).1 This article focuses on the third dimension—Variety—and more specifically on the prevalence of unstructured or semi-structured data (such as text documents, images, or recordings) in most public and private organizations. According to some industry estimates, around 80 per cent of the world’s data is unstructured.2 A large part of this unstructured content is likely to include personal data, making any processing of such data within the European Union (EU) framework subject to the General Data Protection Regulation (GDPR),3 provided the processing is wholly or partly by automated means or, in the case of manual processing, as long as the data processed form part of or are intended to form part of a filing system.4 Manual processing of files or sets of files, as well as their cover pages, which are not structured according to specific criteria thus fall outside the material scope of the GDPR.5 However, since much unstructured data today are processed by automated means or, in the case of manual processing, are likely to be held in a filing system, very little unstructured data will fall outside the material scope of the GDPR.

This means that processing of such data will thus only be permitted if it is done in a lawful, fair, and transparent manner and in accordance with the data protection principles underlying the GDPR.6 Furthermore, any of personal data that is with the for which it is only if the data subject or if permitted by or legal is in of processing for in the public or or is not with the original Article GDPR. long as technical and to Article GDPR are in personal data be processed for such for or a Article GDPR. is not that and the public are to anonymize unstructured and increasingly that any processing will fall outside the scope of the GDPR. the GDPR a broad of what be personal data, much of the legal and technical literature on the of anonymization has focused on what is often structured data such as are characterized by a that must be in and is by the a is as a of to a of (such as or and to a range of (such as a for the or the of for the However, structured are only the of the data and types of data not such In personal that are to in personal a broad of when the or more such as of with personal the of the and the content that data include and which the data The unstructured data types is the that not a we this has implications the of anonymization of such unstructured in such a manner that will be to personal data to the GDPR to as in this The of to anonymize unstructured data such as or images this is at in of the requirements in the has virtually public or private to and unstructured data of some of This data held by as much of is only in the form of text such as to unstructured data personal is a part of and the However, as far as we the legal on it the GDPR or the not focused on the part of the data data. The of unstructured data is not in This article makes two that a risk-based approach to anonymization the most of the GDPR and some for the of unstructured data anonymization that, if we are to what is the most on what to data according to the GDPR, Article 29 Working Party’s Opinion on Techniques the anonymization of unstructured data is This in this strict approach not the of and in unstructured data as we this is far the legal in the of the data and the original data is in WP to unstructured data, this is virtually impossible to to the of (such as the of specific or in text that be to to its original if to the of WP the only to of unstructured data is to the original a that is for most data and in legal we that if this strict approach is the WP 216 to be as part of a public policy This article is structured as The section a broad of the technical by a structured and unstructured data and some of the technical challenges encountered with the anonymization of unstructured data. The section and the legal examines the of data the of of it the of personal data. the two contrasting approaches for determining identifiability that are prevalent the risk-based approach and WP strict which is a of the of the identifiability The section two case to illustrate the challenges encountered in the of anonymization of unstructured data, in if the of WP 216 is to be The section and way the legal challenges in the and proposes a way forward.

A in the of data is and This on the data is while structured data on a unstructured data not a A data is a of data is to be The and most data is the to a and to in data to the The is that the with must be and in In the of is with of and Furthermore, has as to the of that are the of of a must be a and the only a range of of personal data in a of personal data in a This the anonymization as it a of what is that to (such as must be while such as of and are in the of as means that not when in when with and with since the of a are in data which be as in the of which and to the of personal data to Article GDPR. types of data data that is in is the a which is of a of and a be to on or in legal such are more are to must be two In data’ is not by a data The most of unstructured data are text documents in such as or are to and (such as to the of the or a with a are and a text in of any of or Furthermore, in to and types of structured data, the of makes it to the content in we the personal on the be in text form in the on is a and has of the while will on not any their is and will on the content of the text is virtually to a large part of the (such as the and of is The text the of as the and of the be or in the of the and which the of the be that, while a structured per a text personal and their to the text that the the two are and are with the data are not to text documents and images and for types of data often a content are not to a data of any of and any of is that, in their definition of what a WP 216 a definition that only to structured data This the in this a is of to data is to data subject and is of a of for A is a of that be as a a of or as which is increasingly the case This is by the that the in WP 216 are of to structured the section of unstructured of this article the anonymization of unstructured data The and of WP 216 for anonymization of unstructured data is thus structured data, unstructured data often personal images, and and and a of (such as However, to when to personal text or is that is A or a according to the to a which case it a personal to the for the anonymization of unstructured data to which part of the data to the of personal approaches on in the to and this a technological and is approach automated or to that challenges processing images or a range of technological to and such as the and of is a much This is the case for images that not any the private of their data is often in A text be as a long of and as a of or be as a in the of documents or high is in structured as is the case for data on However, structured are to be to are to a data that the with data will often be as of with and In the with a or not with to this and the and the personal it we not which be to in a the anonymization of unstructured data the of that are often the for types of data. and unstructured data in the types of anonymization (such as data or that be In while structured data be by a to a of this is for unstructured data. The range of that be to the of is thus more for unstructured data, are often the only in to the challenges to the of and that to a the anonymization of unstructured data to the to the to its original In the section we this be on two case that on text documents and the GDPR it definition of ‘anonymous the of the GDPR the European the a definition of ‘anonymous data’ which such data the scope of the However, the definition the European on and text and not in the text of the the term is not in the GDPR, in data protection data that is not personal data is to as data is the of personal data. anonymization thus on a of what personal The term data’ is the of data protection that data’ within the scope of the GDPR. data is in article of the GDPR any to or is be or in by to such as a data, or to or more specific to the or of that In its Opinion on the of Data the Article 29 Working the term data’ by it its four constitutive approach that has in data protection that to The constitutive of ‘anonymous are thus the of the four constitutive of is (i) which not (ii) to or This the of ‘anonymous in Recital 26 GDPR as which not to or data, personal data that has a of is to a and thus subject to the However, data in such a manner that the data subject is not or outside the GDPR, Recital 26 GDPR. data which at its not to or such as data on conditions by on or data on for data such for data, is likely to be to its on personal is the data to in and is thus personal This is not as as it data such as data on which to and the of and to the in Recital of the of Data be to data that the such in The of Data Regulation the of that is data of personal and data’ and the case of a data of personal and data, this Regulation to the data part of the data personal and data in a data are this Regulation not the of Regulation (EU) by the European this the of Data Regulation to the data part of the the General Data Protection to the personal data part of the and if the data part and the personal data are the data protection and the General Data Protection Regulation to the when personal data only a part of the the GDPR the of Data Regulation the of According to the European to a a personal data as well as data and the two be impossible or by the to be or not the the scope of the term data’ is very This and approach by the approach by the European as of it to be to and developments not at the that the Data Protection which has a definition of personal data that is the as that in the GDPR, to the of personal data is that is or Recital 26 GDPR the criteria to identifiability in identifiability a is be of the means likely to be such as by the or by to the or means are likely to be to the be of such as the of and the of for identification, the at the of the processing and technological The test is of of by the or by of the a test that is very much in with the risk-based approach in data protection However, as in the to this a approach in WP The examine of two approaches in which is a of which of are when the identifiability The test in Recital 26 GDPR is on the of and some of which are in the According to a of Recital is a of identification, data to be to be personal data and as This that that is be as data, and this be with in WP the Article 29 Working that a to is not to that as the Working the of the means likely to be by the or any in Recital 26 of the Data Protection which is in in Recital 26 that the at be such are the The of The intended of processing that the of the processing the of it be that the or any or will the means to be to the data The of of and technical The in at the of processing, and the for technological developments the of the The technical and that are in place to identification, in place as for the not to be personal data’ outside the scope of the The of for The in WP of and the of the of the well as the the for identification, are specifically in Recital 26 GDPR as of that must be when determining means are likely to be to the The in Recital 26 GDPR is not and thus the must be way of is by what in the of is as by what a and the to a on the the and the Data Protection for the of what to as a The is characterized as a has to such as the and public documents, and is to such as making to The is not to any such as or to to or to to to to the at the data to anonymization is to the of the the to the data the in which the data are to be and must be to in the of is as the by the to the of data’ and in with to the identifiability is focused on structured it the of to the of the data and is thus to some of the challenges encountered when unstructured data. The the of or and that (i) with the (ii) with that or for that A data is thus to of four data, data and The considers data in the in which the is the data and the data data the with the data are and the considers the and on the of the risk-based approach that data in a that in a is a of data and be to be The of according to is the data is or not personal or is a of the that data and its Data and the in are of that to or data for and In the case of only or are to the and data for in in the public a the data be only at and data are in some data is to the in to data on the is to be provided in will only be to will be to or data the In its Opinion on Anonymization Techniques (WP a WP the Article 29 Working a approach and Recital 26 very WP 216 has not by the European Data Protection such and and the to it in In WP the Working the anonymization and and that a is to In that it that are to which to the to some or which in the which is the to at two the data subject or a of data in the or in two by means of that two are to a of in this the not which is the to with the of the of a of the of anonymization and anonymization has criteria must be A according to the Working be it the and of anonymization the criteria as a the Working what has when it that processing personal data in to is the Working Party’s approach in WP that it anonymization with of data.

According to the Working a of the Recital as well as the in Recital 26 and Article of the to or anonymize data or and the in Article of the that data only be processed when such data or with the data means that of as a to personal data in the of as as making it impossible to personal to a WP 216 that, as long as the original data any to which anonymization is to be personal it is to understand that when a data not the original data at and the data part of this or of the is personal be or The for anonymization to WP 216 is thus of the original data. This is of anonymization that, as data since with with the of such in the case of a the for the and for a the in the section of this we with a when we WP strict in a of anonymization of two types of unstructured data, text documents and According to Recital 26 GDPR, the means likely to be the or by to must be to the is The of the of are in a has data which not while the data to the to that data is in the of in In data to of by the and of of a by such to the and of their However, not the data to to the data in the of the that the to the the in are not to underlying this article in that not with with data, the that in is to the in this data that not and that are by be to personal data, in a case has the data to the In the of of the to the in the of the the in data to personal data. General and the as well as the the in to two by or and a or According to the data such as be as personal data in the of such as the of if a third is to the of the data According to the such data be as personal data in to such as the to be not as such with to since that not if has not the of the to In the not for the to a or more nuanced of the The to the means likely to be by the and by in Recital 26 the that, for to be as personal data, is not that the the of the data subject must be in the of However, this not the data in the of a the of in not the means in its to its personal data.

General strict in to the as personal data of of it is in to the of a The as the has to be more nuanced and has to the to a with the data held by the a means likely to be to the data not be the as the on the in the two (i) in the of the data subject by or (ii) if impossible on of the that it a in of and that the of in to be the to the very high when it the of to be the to to to to be a of the risk-based approach and a of the strict approach of WP in some of the in Recital 26 GDPR. The in that the data in the personal data, only of the of legal which the to the to the in the of a In the absence of the data not personal data a third The of the in is for the that Recital 26 by Recital 26 GDPR, a risk-based approach to the of personal data and not the strict approach of WP The that the by any in Recital 26 has to by in Recital 26 GDPR not has that that this in be more and to the of the personal data by the range of be by a to the data subject the that be We that the in very well to a of of that it not the that the the range of since be a third such as or and to to the data as by Article the Working Party’s the its in data protection as on data protection and are likely to data protection it that some data protection not the approach of WP The a more of Recital 26 in its anonymization of of a that it to in its anonymization in its of The Data Protection not it to that it is impossible for any data subject to be in for to be and of the in the as processing which in of which of the data subject We to this in the section and way of this We two case to the anonymization of unstructured data. The case on text documents and to the of this that anonymization of unstructured data that the criteria of WP 216 is impossible to in the data to the original In this case we the to which anonymization of documents is The that will be for this case is a of the European of which are on the of the include in text of in the This not only to the to in the such as and The of for this case is by as a and for personal is in text The of the personal provided in be in the section of the that the that the We of such section in the of the the text of the case types of (such as place and of of that, and with makes it to the in the of the place and of in with the of of will the of to a case original and that to the original are The in and in on 29 two in and In the and that not to such In the for and on the this on and this on on the that it the for to the that not be in to this The that this be to The in the of per The in and in on in In the and that not to such In the for and on the this on and this on on the that it the for to the that not be in to this The that this be to The in the of per The in and two In In the the the that it for the in to this this to The in the The in and in on 29 two in and In the and that not to such In the for and on the this on and this on on the that it the for to the that not be in to this The that this be to The in the of per The in and in on in In the and that not to such In the for and on the this on and this on on the that it the for to the that not be in to this The that this be to The in the of per The in and two In In the the the that it for the in to this this to The in the case original and that to the original are The in and in on 29 two in and In the and that not to such In the for and on the this on and this on on the that it the for to the that not be in to this The that this be to The in the of per The in and in on in In the and that not to such In the for and on the this on and this on on the that it the for to the that not be in to this The that this be to The in the of per The in and two In In the the the that it for the in to this this to The in the The in and in on 29 two in and In the and that not to such In the for and on the this on and this on on the that it the for to the that not be in to this The that this be to The in the of per The in and in on in In the and that not to such In the for and on the this on and this on on the that it the for to the that not be in to this The that this be to The in the of per The in and two In In the the the that it for the in to this this to The in the A to this is to the text and that be to the this be in we a of the of and to a of case and within case text that or to the The text by the in of of public and and of or to any of the The of this manual is in we the of the case is of and that the of the The only that we the the text is that the is most likely a to to public such as the a with and has at in We that, in the absence of to the of are on their to the of that this of and the text to anonymization that with the criteria in WP as the documents be to the original documents a we that the data the the original of documents such data for the that in the to its most likely original in the of in this case only the that which in the to the original when for their within the the and not be be in documents, their within the only be in we to that be to its original this the of most of the which the anonymization this we a that a of documents as and for that, or in the to its The of such a anonymization is in we the text has of and only a such as and such as are This large of is not specific to the in this automated anonymization on in this case we that the of the and original to the on of at 80 per cent of the in Furthermore, if we on which are such as and not such as or this of to per as in it the of not only to most a it the most in of data This be in the text the part of the only content are and of a of in the original the of and the of the and original as the of the The by the of in to the of in the while the by focuses specifically on the of content as and the of and the of the and original as the of the The by the of in to the of in the while the by focuses specifically on the of content as and the are a specific of case documents, are not the of the of only in a of with the of This for very large and for In most of more will only in a of documents and be to documents with their original This case that, for data, anonymization to far the of and the of the original and makes it impossible to text data the text for most at if we that the data a of the original is the The in the case are not specific to text data and be for types of unstructured data such as images, and In this case we on In to personal data, images are a specific of Article GDPR, and are of personal data to Article GDPR. of a of images by the of