Anonymisation
Anonymisation is the process of rendering personal data anonymous in such a way that the data subject is not, or is no longer, identifiable by any means reasonably likely to be used (Recital 26 GDPR). Truly anonymous data falls outside the scope of the GDPR entirely.
The threshold is high. The former Article 29 Working Party (Opinion 05/2014) and the EDPB assess anonymisation against three risks: singling out an individual, linking records relating to the same individual, and inferring information about an individual. If any of these remains reasonably possible, taking into account cost, time and available technology, the data is at most pseudonymised and remains personal data.
In clinical research, coded trial data held by a sponsor is almost never anonymous, because the investigator holds the key. Genuine anonymisation is generally achievable only for aggregated results or for datasets processed with techniques such as k-anonymity, generalisation or differential privacy, and even then the assessment should be documented. Anonymisation is itself a processing operation requiring a legal basis. Compare de-identification under HIPAA, which uses a different, prescriptive standard.
Check whether people remain identifiable through the dataset itself or information reasonably likely to be combined with it. Removing names alone is insufficient. For a trial dataset, examine unusual diagnoses, dates, small groups and available linkage information, then document the assessment and release controls. Reassess the conclusion if the surrounding identification risks change.
