De-Identified Data

What is de-identified data?

De-identified data is information that has been changed so it can no longer reasonably be linked to a particular person. The term comes mostly from US privacy law. California's privacy law, the CCPA, spells it "deidentified."

The CCPA sets a real test, not just a label. Under Section 1798.140(m) of the statute, data counts as deidentified only if it cannot reasonably be used to infer information about, or be linked to, a particular consumer. And the business holding it must:

1. Take reasonable measures so the data cannot be tied back to a person or household.
2. Publicly commit to keep it in deidentified form and not try to re-identify it, except to test its own methods.
3. Make anyone who receives the data agree in a contract to follow the same rules.

How it removes data from protection

Once data meets that test, it leaves the law's protection. Deidentified information is excluded from the CCPA's definition of personal information. Section 1798.145 then says the law does not restrict a business's ability to use, keep, sell or share deidentified data.

This is what makes the word important in vendor terms. A clause that lets a vendor use "de-identified data" for any purpose can move your users' data outside the rules that would otherwise limit it. Zoom's terms of service, for example, let it aggregate technical and other data about how you use the service "on a de-identified or anonymized basis" and use it to develop its services.

Why it matters to you

The legal test is strict, but a contract may use the word loosely. If a vendor calls data de-identified without meeting the three conditions, it may still be personal data. Your users' data could then be used or shared in ways your own privacy policy does not describe.

The CCPA test is also not the GDPR test. Under GDPR Recital 26, data stays personal if someone could identify a person using means reasonably likely to be used. So data that is de-identified for California may still be personal data in the EU. See anonymized data.

What to check

• How the vendor's terms or privacy policy define de-identified data, and whether they track the legal test.
• Whether the vendor publicly commits not to re-identify the data.
• Whether the vendor passes the same duties to anyone it shares the data with.
• What the vendor may do with it, including selling it, sharing it or using it for AI training.

How Venpo helps

Venpo monitors your vendors' privacy policies, terms and DPAs and emails you when a de-identified or aggregated data clause is added or widened. The Fine Print Scan also shows whether each vendor sells your data or trains AI on it.