EstoniaPersonal Data Protection Act, pseudonymised data for research and official statistics (Section 6)
Isikuandmete kaitse seadus, § 6
In force since .
A de-identification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- If you process personal data without the data subject's consent for scientific or historical research or official statistics, process it in pseudonymised form or in a form that gives an equivalent level of data protection, and replace the personal data with such data before you hand it over for that processing (Personal Data Protection Act, Section 6(1)).
- Re-identify pseudonymised data, or any other non-identifying data, only for further scientific or historical research or official statistics (Section 6(2)).
- Designate by name the person who has access to the data that allow depseudonymisation (Section 6(2)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 6 sets conditions for pseudonymised data in research and official statistics and the re-identification limit. It states no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Section 6(1) of the Isikuandmete kaitse seadus (Personal Data Protection Act) allows personal data to be processed without the data subject's consent for scientific or historical research or official statistics, in particular in pseudonymised form or in a form that gives an equivalent level of data protection.
Section 6(1) also requires personal data to be replaced with pseudonymised data, or data giving an equivalent level of protection, before the personal data are handed over for that processing. Section 6(2) permits depseudonymisation, or any other way of making non-identifying data identifying again, only for further scientific or historical research or official statistics.
Section 6(2) requires the processor of the personal data to designate by name the person who has access to the data that allow depseudonymisation.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .