GermanyFederal Data Protection Act, Anonymization of Special-Category Research Data
Bundesdatenschutzgesetz (BDSG), § 27 Abs. 3
In force since .
A de-identification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- If you are a controller processing special categories of personal data for scientific or historical research or statistical purposes, anonymize the data as soon as the research or statistical purpose allows, unless legitimate interests of the data subject conflict (BDSG Section 27, paragraph 3, sentence 1).
- Until the data is anonymized, store separately the attributes that allow individual details to be attributed to an identified or identifiable person, and merge them with the individual details only as far as the research or statistical purpose requires (Section 27, paragraph 3, sentences 2 and 3).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
The provisions state no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Special categories of personal data processed for scientific or historical research or for statistical purposes must be anonymized as soon as the research or statistical purpose allows, unless legitimate interests of the data subject conflict. Until then, the attributes that allow individual details to be attributed to an identified or identifiable person must be stored separately.
The separately stored attributes may be merged with the individual details only as far as the research or statistical purpose requires.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .