Processing which does not require identification

Overview:

Article 11 of GDR addresses situations where personal data is processed without the need to identify the data subject. In this situation the data subject will not identify or store personal data of the data subject. 

Implementation Guidance:

1. Identify the need of processing personal data that can identify the data subject for a specific purpose/activity.
2. If you do not want to identify the data subject for a specific process or activity you need to communicate this with clarity to the data subject
3. You may also have to demonstrate that you are not collecting or storing any personal data for carrying out a business activity or purpose.

Compliance Checklist

1. Privacy Policy
2. Privacy Notice
3. Data Discovery

Examples and Use Cases

1. An online retail company collects customer satisfaction through surveys where the responses are collected anonymously. This essentially means, the company does not collect any data like name, email, phone number etc . that can specifically identify a customer. In this case, the company will have to clearly communicate to the customer that the survey is anonymous and not personal data that can identify them is collected or stored.
2. A healthcare agency collects patient data to study about a blood parameter level of patients. In this case the agency ensures that the data is anonymized and  no personal data is involved in identifying the patient by any means. The institute also informs the stakeholders that the data is completely anonymised and no personal data with identification is stored.