- Anonymization is considered the equivalent of erasure under data protection law, provided that the personal reference is completely removed.
- Anonymization is only permitted if neither the controller nor third parties can restore the personal reference without disproportionate effort.
In practice, the question often arises as to whether it is sufficient to anonymize personal data instead of deleting it. The GDPR does not provide any clear information on this. However, it clearly follows from the meaning of data protection law that the Anonymization must be sufficient:
- The regulatory claim of data protection law ends in principle with the removal of the reference to persons. In other words: Data protection law cannot exceed its material scope of application, even with regard to the issue of deletion.
- It is true that in anonymization the controller pursues a specific purpose – the further use of the anonymized data – which is not the case with deletion. However, since this purpose is not limited to Peopledata, data protection law cannot or must not be of interest for this purpose.
- The controller would be allowed to obtain the anonymous data at any time without having to comply with data protection requirements (provided that the data also remain anonymous during his own processing). It would be contradictory to prohibit him from anonymizing the data if he is free to retrieve it.
From this, it had to be concluded that anonymization is equivalent to deletion in terms of data protection law, i.e. it is a deletion equivalent, and is therefore always permissible without further ado if deletion is permitted or required.
This question has now also been addressed by the Austrian supervisory authority deals (Decision DSB-D123.270/0009-DSB/2018 of December 5, 2018.). In response to a request for deletion, the controller had confirmed that it had either deleted the applicant’s data or “anonymized it in compliance with the GDPR,” depending on the system. This procedure is equivalent to deletion. The data protection authority agrees with the data controller: The GDPR does not define the term “deletion”. However, it follows from Article 4(2) of the GDPR that deletion and destruction are two different things, which in turn means that deletion does not necessarily require final destruction. The removal of the personal reference could also be a possible means of deletion within the meaning of Art. 4(2) in conjunction with Art. 17(1) GDPR. Art. 17(1) GDPR. However, the anonymization must be a complete one:
It must […] be ensured that neither the responsible party itself nor a third party can restore a personal reference without disproportionate effort […]. Only if the responsible party aggregates the data in the result on a level so that no individual events are identifiable any more, the resulting data stock can be called anonymous (i.e. without personal reference) (cf. the Statement 5/2014 on anonymization techniques by the former Article 29 Working Party, WP216, p. 10).