Cheat Sheet on Personal Data Management: Data Masking

Research Data Management Network Personal Data Management Data Masking In research, personal data have to be anonymized or pseudonymized as soon as the processing purpose permits. Personal data may only be processed with the informed consent of the person concerned. This guide explains the basic terms. Defi nitions Pseudonymization refers to the removal of personal references, whereby a mapping key (i.e., a table that translates pseudonym, e.g. study identifi er (ID), to person) is retained for the re-personalization of the information. If data is pseudonymized, the conditions under which a person may be identifi ed and how the mapping key is stored must be regulated (key management). Unlike anonymized data, pseudonymized data remain personal data. Anonymization means that the reference to a person is irreversibly (= defi nitively) removed in such a way that it is no longer possible to identify the individual without disproportionate effort. Anonymized data are no longer regarded as personal data. Encryption is a method of protecting data from unauthorized access. It means that a plain text is converted (encoded) into a non-interpretable character string (ciphertext) by means of an encryption procedure. One or more keys (= codes) are used as crucial parameters for encryption. Secure encryption makes it practically impossible to retrieve the plain text without the appropriate key. However, secure encryption must be done correctly. When in doubt, contact your IT. Useful data anonymization tools • ARX • Argus • scdMicro • QualiAnon Research Data Management Network https://researchdata.unibas.ch • This work is licensed under CC-BY 4.0. • [email protected] Illustration by [email protected], modifi ed Research Data Management Network Research Data Management Network https://researchdata.unibas.ch • This work is licensed under CC-BY 4.0. • [email protected] Illustration by [email protected], modifi ed Data Masking Example Collected data The original data contains personal data (in this case: name, date of birth, disease and treatment) and is assigned a study ID. Pseudonymized data Pseudonymized data refer to datasets in which direct identifi ers (in this case: name and date of birth) are replaced with a unique pseudonym (ID). The mapping key – required to re-identify the data subject – is stored separately from the research dataset. While pseudonymization reduces the risk of direct identifi cation, re-identifi cation remains possible if the mapping key is accessed and linked to the pseudonymized data. Anonymized data The mapping key is deleted, which means that it is no longer possible to link the ID in the research table to the personal data originally associated with that ID. Encrypted data Encrypted data have been converted from its original, readable form into an unreadable, encoded format through cryptographic algorithms. Access to the original information is restricted to authorized parties in possession of the appropriate decryption key. ID Name Date of birth Disease Treatment DS001 Alan Smith 01.06.2001 Appendicitis Operation ID Name Date of birth Disease Treatment DS001 Alan Smith 01.06.2001 ID Name Date of birth Disease Treatment DS001 Appendicitis Operation Mapping Key ID Name Date of birth Disease Treatment DS001 Appendicitis Operation ID Name Date of birth Disease Treatment ZTUVqwEAb Uf+M0tKeQX zQVjnI3VMM vJTdpgB9eIM bzs xu05js8QCrn 9 0 I j 1 u a fl S z U y bf8uMEvrDT+ KSXvJY24 lYtVtyocsRqT l6QANxqfDc jxxvRHSWEG jQY54ddSvzE TOP2AMUh /Fgs2XhoCY 2Zv30qaKP wZ/4A7t1Fp LcRBng P7Hz796XwSk PXeQvGv2PG cR8XUmG/lC0 kSkv6n/bnlc