Section 172 — Data Protection Act 2018: Re-identification: effectiveness testing conditions

Re-identification: effectiveness testing conditions 172 1 For the purposes of section 171, in relation to a person who re-identifies information that is de-identified personal data, “ the effectiveness testing conditions ” means the conditions in subsections (2) and (3).

2 The first condition is that the person acted—

a with a view to testing the effectiveness of the de-identification of personal data, b without intending to cause, or threaten to cause, damage or distress to a person, and c in the reasonable belief that, in the particular circumstances, re-identifying the information was justified as being in the public interest.

3 The second condition is that the person notified the Commissioner or the controller responsible for de-identifying the personal data about the re-identification—

a without undue delay, and b where feasible, not later than 72 hours after becoming aware of it.

4 Where there is more than one controller responsible for de-identifying personal data, the requirement in subsection (3) is satisfied if one or more of them is notified.