Our response to the ICO anonymisation and pseudonymisation consultation

The Information Commission (ICO) has been consulting on draft guidance about the use of anonymisation and pseudonymisation for research purposes. The guidance is intended to help organisations understand when information is personal data, how identifiability should be assessed and how these principles apply in research settings, including trusted research environments (TREs) and secure data environments (SDEs).

We have responded because these questions are particularly important in health and social care research, where research sponsors, data providers, TRE/SDE operators and researchers may have different roles at different stages of the research process.

Our response asks for greater clarity on how controller, processor and joint-controller relationships should be considered, including when assessing whether information is anonymous in a particular organisation’s hands.

We also highlight the need to distinguish between accessing and analysing information within a TRE/SDE and the subsequent disclosure of outputs, and to recognise the role of the research sponsor as controller for the research processing. We have encouraged the Information Commission to use realistic health and social care research examples to show how the guidance should work in practice.

Data protection is only one part of the wider governance framework for research. Our response therefore also highlights the importance of keeping questions about identifiability under data protection law distinct from, but appropriately aligned with, the common law duty of confidentiality and wider research governance requirements.

We will continue to work with the Information Commission and partners across the health and care system to support clear, consistent and proportionate guidance for researchers and organisations using health and care data.