Recent CNIL and Garante Decisions Highlight SRB’s Limitations for Anonymity in EU Health Data

**Recent CNIL and Garante Decisions Highlight SRB’s Limitations for Anonymity in EU Health Data**

In recent months, significant decisions by the French data protection authority (CNIL) and the Italian data protection authority (Garante) have underscored the limitations of the Statistical Re-identification Benchmark (SRB) in ensuring anonymity within European Union health data. These decisions have sparked a broader discussion on the adequacy of current anonymization techniques and the need for more robust data protection measures in the health sector.

**Background on SRB and Anonymization**

The Statistical Re-identification Benchmark (SRB) is a widely used method for assessing the risk of re-identification in datasets that have been anonymized. It is designed to evaluate whether the anonymization techniques applied to a dataset are sufficient to prevent individuals from being re-identified. Anonymization is crucial in the health sector, where sensitive personal data is often processed and shared for research, policy-making, and public health purposes.

**CNIL’s Decision**

The CNIL recently reviewed a case involving the use of SRB in a large-scale health data project. The authority found that the SRB, while useful, was insufficient in ensuring full anonymity of the data subjects. The decision highlighted that even when SRB indicated a low risk of re-identification, the possibility of combining the anonymized data with other available datasets could lead to the re-identification of individuals. CNIL emphasized the need for data controllers to implement additional safeguards and to continuously monitor the effectiveness of anonymization techniques.

**Garante’s Decision**

Similarly, the Italian Garante examined a case where health data had been anonymized using SRB. The Garante’s findings echoed those of CNIL, noting that the SRB did not adequately account for the evolving landscape of data analytics and the increasing availability of auxiliary information that could be used to re-identify individuals. The Garante stressed the importance of adopting a dynamic approach to anonymization, one that considers the context and potential future risks associated with data sharing and processing.

**Implications for EU Health Data**

These decisions by CNIL and Garante have significant implications for the handling of health data in the EU. They highlight the need for a more comprehensive approach to data anonymization, one that goes beyond traditional benchmarks like SRB. Data controllers are urged to adopt a risk-based approach, considering the specific context of their data processing activities and the potential for re-identification.

Moreover, these decisions may prompt a reevaluation of existing guidelines and regulations related to data anonymization in the EU. There is a growing call for updated standards that reflect the complexities of modern data environments and the capabilities of advanced data analytics.

**Conclusion**

The recent decisions by CNIL and Garante serve as a wake-up call for organizations handling health data in the EU. They underscore the limitations of relying solely on SRB for anonymization and highlight the need for more robust, context-aware data protection strategies. As the landscape of data processing continues to evolve, so too must the methods and standards for ensuring the privacy and anonymity of individuals in health data.