Seven million for data believed to be anonymous

The company's defence was the most common one in this field: the data is anonymous, so the GDPR does not apply. The reasoning is formally sound — recital 26 does say the Regulation does not concern anonymous information — and almost always wrong in fact. The point is not whether the name is there: it is whether the person can be found again.

The line between anonymous and pseudonymised

In the database each patient had a code. Not a name, a code. But that code was stable: it served to follow the same person over time, because that is exactly what a longitudinal study must do. An identifier that allows one person's data to be linked together is not an anonymisation measure: it is the definition of pseudonymisation in Article 4(5). And pseudonymised data is still personal data.

• Recital 26 asks you to consider the means reasonably likely to be used to identify: cost, time, available technology — not absolute impossibility.
• A stable per-person code allows events to be linked over time, and that is precisely what makes the data attributable.
• Year of birth, sex, diagnoses, prescriptions and a territorial reference, taken together, narrow the field down to very few people.
• Whoever claims data is anonymous must be able to demonstrate it, and the demonstration is technical: a re-identification analysis, not a sentence in a privacy notice.
• If the data is not anonymous you need a legal basis and a notice, and for health data also a condition under Article 9(2).

Then there is the upstream side. The data came from general practitioners. For a DPO advising a medical practice, a laboratory or a healthcare provider, today's question is whether any of their data ends up in research or commercial-information databases, on what legal basis, and whether patients know. The fact that a third party does the processing does not move the responsibility of whoever collected it.

What to take away, concretely. The word «anonymous» in a contract or in a register of processing is not a legal qualification: it is a claim that must be proved. Wherever it appears, it is worth asking three things — who verified it, by what method, and when. If those three answers are missing, that line of the register describes a processing operation believed to be outside the GDPR which is in fact inside it, with everything that follows.