Privacy in Modern Data Economy : Discussing approaches that interpret anonymisation as an alternative to erasure under European Data Law

Tiivistelmä - Referat - Abstract In the modern European data economy two central ideals are in tension. Collection and processing of personal data is central to the commerce, development and innovation in Europe, but these interests must be balanced with robust protections for the human right to privacy. Anonymisation of personal data has been seen by some to have high potential to ease the tension between the interest to use data and the protection of the individual’s privacy. This approach has been examined by many European actors, including Data Protection Authorities. Further, there is precedent of anonymisation being interpreted as an equal alternative to erasure, in a specific case after a right to erasure request was made by a data subject in a commercial relationship. In this thesis I discuss anonymisation in the European data law, and specifically whether the approaches that promote the view that anonymisation can be understood as an erasure alternative are in line with the European Data law. I examine anonymisation with a dogmatic method and connect the legal understanding to perspectives of how anonymisation and erasure are understood in data science. To discover whether these approaches are incompatible with the European data law, I pose the question of whether anonymisation fulfils the protections laid out in Article 17 of General Data Protection Regulation (EU) 2016/679. To answer this question, I define the framework of successful application of the protections of the right to erasure, and with this methodology comparatively analyse erasure and anonymisation against the common criteria. It emerges that the concept of anonymisation is not clearly defined by the European primary sources, and further that the Data Protection Authorities’ approaches vary. Concepts of personal data and anonymous data are not in symmetry, and there is grey area around these terms. European legal understanding anonymisation as a concept, and to a lesser degree erasure, are distanced from the data science understanding of the terms. Developing a more nuanced understanding of anonymisation, both as a concept and its types and goals specifically, would provide tools for the European Data Law to create a more robust and future-proof legal framework. These findings show that European Data Law develop a more full and nuanced understanding of these concepts and their connections. In this way, the European Data Law could foster a bright, secure and balanced legal framework, creating opportunities and security for both data subjects and data controllers alike