An analytics team claims hashing a national ID always makes the dataset anonymous. Which distinction should the DPO enforce?
Select an answer to reveal the explanation.
Short Explanation
Hashing is often a mask, not a vanishing spell. If someone can still link the hash back to a person—key, salt notebook, brute force—you are usually in pseudonymisation land, and GDPR still applies. Real anonymisation means the identification risk is genuinely gone.
Full Explanation
If re-identification remains reasonably possible, hashed identifiers are typically still personal data (often pseudonymous); truly anonymous data requires irreversible identification risk reduction that takes the data outside GDPR. Analytics teams that claim hashing a national ID always anonymises the dataset confuse a technical transform with a legal outcome under Recital 26. Any hash does not automatically place data outside GDPR forever. Pseudonymisation and anonymisation are not identical GDPR terms with the same legal effect. Anonymous data does not remain fully subject to all GDPR controller obligations as if identified. Exam caveat: hash ≠ automatic anonymity; pseudonymised data remains personal data. Operational check: before publishing “anonymous” civic analytics, run a re-identification risk assessment that considers reasonably available means and whether keys or reverse lookups still exist—then classify as personal, pseudonymous, or anonymous accordingly. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.