👤tormeh🕑7y🔼53🗨️10
(Replying to PARENT post)
I think it is worth noting that pseudonymization is not just this big loophole in the GDPR and pseudonomyzed data can still be considered personal data and fall under GDPRs jurisdiction.
Pseudonymisation != Anonymization. And as the article 29 working party has concluded [0] might sometimes not be sufficient to protect users privacy.
[0] http://ec.europa.eu/justice/article-29/documentation/opinion...
👤tephra🕑7y🔼0🗨️0
(Replying to PARENT post)
👤neonate🕑7y🔼0🗨️0
(Replying to PARENT post)
The result is a new set of data that contains no personal information, but retains the format and statistics of the original. The only way that each field in the new data set can be returned to its old state is by applying the key used to generate the hash
these keys are held by the accounts teams. The development teams working on the pseudonymous data never see them
Right ... but I would feel better if I supply this hash/key back to them. I understand I can request erasure, but I would like the option to request "hashed" (or a user friendlier term) when I want to keep my data on their server, but I control it.
👤pcunite🕑7y🔼0🗨️0
(Replying to PARENT post)
Not only it makes the data handling safe and anonymised, you also avoid crazy stuff like mistakenly sending a batch email to prod users while you are testing stuff in dev/prod (been there, done that).
I found that clever when I first saw we were doing that, but it seemed simple enough that I just assumed every company did it.