California's test
CCPA deidentified data definition: Civil Code 1798.140, quoted
Updated
Where HIPAA's safe harbor lists identifiers to remove, California's definition asks a different question: whether the information can still be tied to a particular consumer.
The definition
California Civil Code 1798.140 says "deidentified" means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer.
Source: California Civil Code section 1798.140, CCPA definitions
The three conditions on the business
- Take reasonable measures to ensure that the information cannot be associated with a consumer or household.
- Publicly commit to maintain and use the information in deidentified form and not to attempt to reidentify it.
- Contractually obligate any recipients of the information to comply with all provisions of the subdivision.
Source: California Civil Code section 1798.140, CCPA definitions
The second condition carries one exception: the business may attempt to reidentify the information solely to determine whether its deidentification processes satisfy the requirements of the subdivision. The third is the one a licence carries: a buyer who receives the data is a recipient, and the business must contractually obligate it to comply with all provisions of the subdivision.
Where the CCPA sits on the board
Of the 6 standards on the table, this is the one written for California consumers and households. A dataset that also holds health records or EU personal data may fall under the HIPAA or GDPR text as well, and the tool on the home page shows each in its own words.