Section 171: Re-identification of de-identified personal data, Data Protection Act 2018

It is an offence for a person knowingly or recklessly to re-identify information that is de-identified personal data without the consent of the controller responsible for de-identifying the personal data.

For the purposes of this section and section 172—

personal data is "de-identified" if it has been processed in such a manner that it can no longer be attributed, without more, to a specific data subject;

a person "re-identifies" information if the person takes steps which result in the information no longer being de-identified within the meaning of paragraph (a).

It is a defence for a person charged with an offence under subsection (1) to prove that the re-identification—

was necessary for the purposes of preventing , investigating or detecting crime,

was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or

in the particular circumstances, was justified as being in the public interest.

It is also a defence for a person charged with an offence under subsection (1) to prove that—

the person acted in the reasonable belief that the person—

is the data subject to whom the information relates,

had the consent of that data subject, or

would have had such consent if the data subject had known about the re-identification and the circumstances of it,

the person acted in the reasonable belief that the person—

is the controller responsible for de-identifying the personal data,

had the consent of that controller, or

would have had such consent if that controller had known about the re-identification and the circumstances of it,

the person acted—

for the special purposes,

with a view to the publication by a person of any journalistic, academic, artistic or literary material, and

in the reasonable belief that in the particular circumstances the re-identification was justified as being in the public interest, or

the effectiveness testing conditions were met (see section 172).

It is an offence for a person knowingly or recklessly to process personal data that is information that has been re-identified where the person does so—

without the consent of the controller responsible for de-identifying the personal data, and

in circumstances in which the re-identification was an offence under subsection (1).

It is a defence for a person charged with an offence under subsection (5) to prove that the processing—

was necessary for the purposes of preventing , investigating or detecting crime,

was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or

in the particular circumstances, was justified as being in the public interest.

It is also a defence for a person charged with an offence under subsection (5) to prove that—

the person acted in the reasonable belief that the processing was lawful,

the person acted in the reasonable belief that the person—

had the consent of the controller responsible for de-identifying the personal data, or

would have had such consent if that controller had known about the processing and the circumstances of it, or

the person acted—

for the special purposes,

with a view to the publication by a person of any journalistic, academic, artistic or literary material, and

in the reasonable belief that in the particular circumstances the processing was justified as being in the public interest.

In this section—

references to the consent of a controller do not include the consent of a person who is a controller by virtue of Article 28(10) of the UK GDPR or section 59(8) or 105(3) of this Act (processor to be treated as controller in certain circumstances);

where there is more than one controller, such references are references to the consent of one or more of them.

Section 171: Re-identification of de-identified personal data

Discussed in

About this text