When data is not needed, it should either be deleted, or not collected in the first place. For example, if photographs are used in observations, measures may consist of “taking care to avoid capturing people without their knowledge/consent (data avoidance), or if already captured in the photo, blurring, cropping and/or deleting them from the photo. (data deletion)“.

Data can be deidentified by partially or completely removing identifiable information like names, emails; generalizing, diluting or aggregating indirectly identifiable information (e.g., replace birthdate with age), etc. Appropriate deidentification measures must be driven by the necessity of the data – too much deletion may impair the processing viability, whereas too little may create unnecessary risks. More information on deidentification measures can be found here.

Keep in mind that deidentification is sometimes mistakenly equated to anonymisation, however deidentification is only the first step of anonymisation. A de-identified dataset may easily be re-identified when combined with data that is publicly or easily accessible, as is explained in here. The AEPD has published a helpful resource with more information around this topic, and the PDPC has also published a handy guide to basic anonymisation.

Sometimes, data is only needed at certain points of the processing activity, so it is not possible nor desirable to fully delete personal identifiers. In those cases, data is instead replaced by one or more artificial identifiers – pseudonyms. A single pseudonym for each replaced field or collection of replaced fields makes the data record less identifiable while remaining suitable for data analysis and data processing. Unlike anonymisation, pseudonymisation enables re-identification, as ‘additional information’ (like reidentification keys) is created and kept separate – reversible pseudonymisation. If this reidentification information is deleted (or not created in the first place), then pseudonymisation becomes irreversible – and irreversible pseudonymisation is actually a data deidentification method. When describing pseudonymisation measures, do not forget to describe how the reidentification key is managed and ultimately deleted.

More information on data pseudonymisation techniques is available on this ENISA guide.

Personal data that has been sufficiently deidentified becomes anonymous, once it has been proved that it can’t be re-identified – and for some datasets, this is a high bar, as explained in the EDPB Opinion 05/2014 on Anonymization Techniques. See also the resources mentioned in data deidentification above.

Data encryption is a useful measure to apply to data that is in storage or transport – not being used at the time. When encrypting data, it is important to store the key to decrypt the data in a safe location – once the key is lost, access to the data is also lost. A common and easy approach to encrypt files and folders is to use 7-zip to produce an encrypted zip file, but other tools and approaches are also available.

Communicating with data subjects is often done via email, phone, or other means. While this is ok in many situations, sometimes a better way is preferable. The issue with communication tools like email and other phone-based tools like Signal, is that they rely on rarely changed, uniquely identifiers (email address or phone numbers) that are rarely changed or updated. Once these are shared (or leaked), they are difficult to control – spam and phone scamming are examples of risks associated with this loss of control.

Common measures to address these shortcomings include creating project-specific identifiers. For example, a project-associated email or phone number can be used to communicate with data subjects. It is also possible to use privacy-focused tools such as SimpleX, Scyncthing and SURFDrive.

• SimpleX is a Signal-like open-source messaging tool that does not require a phone number to work. In fact, it does not have any User IDs. Instead, it relies on temporary anonymous pairwise addresses and credentials which are unique for each user contact or group member – contacts need to be invited, and once credentials are deleted, contact can’t be reestablished, which means spam or unknown callers are not possible.
• Scyncthing is an open source continuous file synchronization application that facilitates sharing data between devices. Each device (laptop, mobile phone, tablet) is identified by a device ID, and shared with other user’s devices, and once authenticated, selected folders can be synchronized in real time in a peer-to-peer, privately and secure manner – For a connection to be established, both devices need to know about the other’s device ID, but knowing a device ID is not enough to actually establish a connection to that device or get a list of files, etc. The Device ID is actually the public part of a public/private 384 bit ECDSA key pair, so it can be used for address resolution, authentication and authorization. More information is available on the documentation page.
• SURFDrive is a good alternative to Microsoft OneDrive, especially useful for sharing data with non-UU data subjects. SURFDrive has different options for sharing and access control: Access can be granted based on email, or using unique links (called public links – but despite the name, these links can be password protected, ensuring only intended recipients get access). Access to shared folders can also be granularly controlled: Link recipients can view or download contents (Download / View); view, download and upload contents (Download / View / Upload); or view, download, edit, delete and upload contents (Download / View / Upload / Edit). Quite useful, you can also set it up to receive files from link recipients without revealing the actual contents of the folder (Upload only – File Drop).

Qualtrics is an online survey tool approved for use at the UU. When using this tool, it is important to ensure that data collection and use is minimised as much as possible, considering the needs of the project. For example, in broad terms, online surveys can use either individualized or general links – either unique different links specific to each targeted individual are used, or the same link is used for all targeted individuals. In Qualtrics, they are called trackable and reusable links, respectively. Which type to use depends on the goals of the project: trackable links are appropriate to use when it is actually necessary to get responses from specifically targeted individuals. Otherwise, reusable links are likely sufficient for most survey projects, as these links need much less personal data processing than tracked links – so their use should be preferred as much as possible. Qualtrics also have several security and fraud detection settings that may be necessary to use by the project, but that also have an impact on privacy. If these settings are applied, make sure they are properly described and justified. Also make sure to describe whether the survey will be using cookies or collecting respondents IP addresses and location.

• Home
• Administrative Information

1. Description of the Project’s Purpose
2. Description of Data Subjects
3. Description of the Categories and Purposes of Personal Data
4. Description of the Processing of Personal Data
5. Description of Information Provided to Data Subjects
6. Description of How Data Subjects Can Exercise Their Data Subject Rights
7. Description of Lawful Basis for Processing
8. Description of Measures to Ensure Compliance By Processors and/or Joint Controllers
9. Description of Planned Transfers of Personal Data to Other Countries Outside the EU
10. Obtaining, Consulting, and Dealing with Data Subjects’ Views of the Processing
11. Preliminary Risk Assessment