An analytics team claims hashing a national ID always makes the dataset anonymous. Which distinction should the DPO enforce?
Select an answer to reveal the explanation.
Short Explanation
Hashing is often a mask, not a vanishing spell. If someone can still link the hash back to a person—key, salt notebook, brute force—you are usually in pseudonymisation land, and GDPR still applies. Real anonymisation means the identification risk is genuinely gone.
Full Explanation
GDPR Recital 26 and related guidance distinguish anonymous information (not relating to an identifiable person) from personal data, including pseudonymised data that can be attributed to a natural person with additional information. Hashing a national ID does not automatically achieve anonymisation if re-identification remains reasonably likely. Pseudonymised data remains personal data; only robust anonymisation removes GDPR application.