Processes de-identified data, in the United Kingdom

Data Protection Act 2018 (c. 12), ss. 171 and 172 · Read the law's page

• Do not knowingly or recklessly re-identify information that is de-identified personal data without the consent of the controller responsible for de-identifying the personal data (section 171(1)).
• Do not knowingly or recklessly process personal data that is information that has been re-identified, without the consent of the controller responsible for de-identifying it, in circumstances in which the re-identification was an offence under section 171(1) (section 171(5)).
• To rely on the effectiveness testing defence for re-identifying, act with a view to testing the effectiveness of the de-identification, without intending to cause or threaten damage or distress, in the reasonable belief that re-identifying was justified in the public interest, and notify the Commission or the controller without undue delay and, where feasible, within 72 hours of becoming aware of it (section 171(4)(d) and section 172).

UK GDPR, Arts. 4(1) and 11 · Read the law's page

• Where you can demonstrate that you are not in a position to identify the data subject because the purposes of your processing do not or no longer require identification, inform the data subject accordingly, if possible (Article 11(2)).
• Where Article 11(2) applies, give effect to a data subject's rights under Articles 15 to 20 once the data subject provides additional information enabling identification (Article 11(2)).