This clause sets the standard for "anonymizing" data—removing or scrambling personal information so people can no longer be identified. This is important because truly anonymized data is no longer covered by data protection laws, so companies can use it more freely. However, "anonymization" is tricky: if you remove names but keep postal codes and birthdates, someone might still identify individuals (this happened in a famous case where Netflix data was re-identified). The clause should specify exactly what anonymization method will be used (like hashing, encryption, or aggregation) and who verifies it worked. A weak anonymization standard puts people at privacy risk and exposes your company to regulatory action.
Insist on a specific, technical anonymization method—don't accept vague language like "anonymized in accordance with best practices." Request that anonymization be verified by an independent third party or security expert before data is considered truly anonymized. Include a clause stating that if anonymization fails and people can be re-identified, the data reverts to being "personal data" and full data protection rules apply again. ---
Frequently Asked Questions
What does this clause mean in simple terms?
This clause sets the standard for "anonymizing" data—removing or scrambling personal information so people can no longer be identified.
Why should I care about this clause?
This is important because truly anonymized data is no longer covered by data protection laws, so companies can use it more freely.
What are my options?
However, "anonymization" is tricky: if you remove names but keep postal codes and birthdates, someone might still identify individuals (this happened in a famous case where Netflix data was re-identified).
How does this affect small businesses?
The clause should specify exactly what anonymization method will be used (like hashing, encryption, or aggregation) and who verifies it worked.