Statistics Law (Statistikas likums), anonymisation and non-identifying release of statistical data
Statistikas likums, s. 17(5), s. 19(1), s. 26(1) and s. 28(5)
In force since .
A de-identification rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Retention, Governance
What it requires
- The statistics authority must anonymise personal data obtained for official statistics immediately after obtaining, checking and linking them, unless they are still needed for official statistics, and must store identifying data separately and securely from other data (Statistics Law s. 17(5)).
- The statistics authority must release official statistics in a form that does not allow a private person or state institution to be identified directly or indirectly, except in the cases in section 25 (s. 19(1)).
- The statistics authority must give access for research work only to indirectly identifiable data that it can protect with suitable disclosure control methods (s. 26(1)), and must refuse access where the requester does not ensure suitable protection and disclosure control of those data (s. 28(5)).
These lines are LexLint's reading of the law's text.
What this law does
Section 17(5) of the Statistics Law requires the statistics authority to anonymise personal data obtained for official statistics immediately after the data are obtained, checked and linked, unless the personal data are still needed for official statistics, and to keep identifying data separately and securely from other data.
Section 19(1) requires the statistics authority to release official statistics in a form that does not allow a private person or a state institution to be identified directly or indirectly, except in the cases set out in section 25. Section 26(1) requires the statistics authority to give access for research work only to indirectly identifiable data that it can protect with suitable disclosure control methods.
Section 28(5) bars the authority from granting access to indirectly identifiable data where the requester does not ensure suitable protection and disclosure control of those data. The Law has been in force since .
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .