Pseudonymity definition

Site Development
1

I have just read the definitions in the home page of privacyguides.org.

I was struck by the pseudonymity definition as it’s very different than what I am used to. Then I thought there may be different definitions depending on jurisdictions (or just cultures or countries). Maybe it’s worth mentioning in that definition, in privacyguides.org, that there are other definitions.

What is called pseudonymity in European Law (GDPR) is very different from what is here. In European Law, pseudonymity is defined as data with no direct identifier but with any possibility (including by cross-matching with other datasets or using a decryption key) to retrieve the identity. It is described as a good practice in a workflow when sharing data with colleagues who don’t need to know of the concerned people’s identity. However, it is not regarded as anonymisation, which implies it must be treated (protected, not shared with third-parties etc.) exactly as Personal Data.

(In European Law, the definition of Personal Data is any data allowing identification in any way, even if it requires additional data, including a decryption key).

So, in European Law, some data where the people’s names are replaced by ID numbers or AES-encrypted names (both called “pseudonyms”) are :

  • Personal Data if there is some dataset somewhere that allows matching the IDs and the names (or other identity item like passport number etc.), or in the case of encryption, if the key is retrievable somehow.
  • Non-Personal data if there is no such a dataset or if the encryption is irreversible (solid hash instead of AES, or AES key being long, random, and irreversibly destroyed), and the other data points don’t have a unique or rare combination of values that single out one person or a couple of individuals (a unique or rare combination of values is then considered as a pseudonym).

So the example given in the home page here, where someone has a pseudonym like @kevin02 but no one knows their true identity is regarded as anonymity in European Law (if there is truly no one being able to retrieve the real identity), not pseudonymity. However, it’s considered pseudonymity (thus, to be protected as Personal identifiable data) in case there is a dataset somewhere (typically, in the IS of the platform where that kevin02 created the account) that links “kevin02” to a real name, or a credit card number, or a biometric-friendly picture, or a set of information allowing to retrieve who is behind kevin02 (zip code, birthdate, gender are enough to identify most people as documented by a US researcher).

2

It’s common to provide a unique definition for a set of terms used in legalese for the sake of brevity. A complex concept can be shortened to just one word if you provide a specific definition for a word you’d like to use within a specific context. These usually are not general purpose or even accurate definitions, otherwise you’d just need a dictionary to understand what it means without any clarification from the author. This is the case with “pseudonymity”.

Any English dictionary (including Mariam-Webster, Cambridge, Dictionary.com, etc) defines it as Privacy Guides has, not how the GDPR uses it in its unique purpose-specific way.

3

To bring it full circle, what your describing is defined as a term of art.