Part 6: Enforcement Section 171: Re-identification of de-identified personal data
This section creates a new offence of knowingly or recklessly re-identifying information that has been de-identified without the consent of the controller who de-identified the data. This responds to concerns about the security of de-identified data held in online files. For example, recommendations in the Review of Data Security, Consent and Opt-Outs by the National Data Guardian for Health and Care called for the Government to introduce stronger sanctions to protect de-identified patient data.
	Subsection (1) sets out the elements of the offence.
	Subsection (2) defines the meaning of "de-identification" and "re-identification" for the purposes of the offence and reflects the definition of pseudonymisation in Article 4(5) of the GDPR.
	Subsection (3) provides the defendant with a defence if he or she can prove that re-identification was necessary for the purposes of preventing crime, for complying with a legal obligation or was justified as being in the public interest.
	Subsection (4) provides further defences where the defendant can prove that: they reasonably believed that they had (or would have had) the consent of the data subjects to whom the information relates; they reasonably believed that they had (or would have had) the consent of the data controller responsible for de-identifying the information; or they acted for the special purposes, with a view to publication and the re-identification was reasonably believed to be justified as being in the public interest; or the effectiveness testing conditions as stated in section 172 (re-identification: effectiveness testing conditions) were met.
	Subsection (5) creates a related offence of knowingly or recklessly processing personal data that has been unlawfully re-identified.
	Subsection (6) provides a defence where the person charged with an offence under subsection (5) can prove that processing of the re-identified information was necessary for the purposes of preventing crime, for complying with a legal obligation or was justified as being in the public interest.
	Subsection (7) provides further defences where the person can prove that he or she acted in the reasonable belief that the processing was lawful or that he or she had the consent of the controller who had de-identified the information or would have had such consent if the controller had known about the processing.
	As worded, the section places a legal burden on the defendant to prove the relevant defences on the balance of probabilities.