A research unit replaces names with codes but keeps the key, then calls the file “anonymous open data.” Which label is correct under GDPR?
Select an answer to reveal the explanation.
Short Explanation
If the decoder ring still sits in the drawer, the costumes are not true anonymity. Codes plus a retained key equal classic pseudonymisation—still personal data under GDPR. Renaming the folder “anonymous open data” does not finish the magic trick.
Full Explanation
Presence of a re-identification key means the coded dataset is typically pseudonymised personal data still within GDPR scope, not anonymous open data. Research units that replace names with codes while keeping the key remain under personal-data rules, including security and purpose limitation. Keeping a re-identification key does not convert the dataset into anonymous data outside GDPR. Coded research files are not exempt whenever “open data” appears in a filename. Pseudonymisation does not remove all controller obligations. Exam caveat: key retained = pseudonymisation, not anonymisation. Operational check: if publishing civic research outputs, strip or destroy re-identification keys under a documented anonymisation method—or publish only under personal-data rules with a lawful basis and safeguards, never under a false “anonymous open data” label. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis.