A contribution towards the regulation of anonymised datasets within the framework of GDPR

The European Union’s General Data Protection Regulation legal framework outlines data anonymisation as an effective method to help data processors meet their legal obligations. Once personal data has been anonymised, GDPR no longer recognises it as personal data and it becomes free to be processed unregulated. The potential capacity for re-identification of any anonymised dataset brings into question the value of anonymisation and whether it should be regulated to ensure the privacy of data subjects. This paper identifies and reviews some of these problems, challenges the current set of regulations, and recommends maintaining regulation over anonymised datasets, and enforcing systems of traceability and erasure of datasets over time, which would increase the value of utilising anonymisation and its capacity to be a reliable system for data privacy.