# Data Protection Act 2018, Section 172: Re-identification: effectiveness testing conditions


(1) For the purposes of section 171, in relation to a person who re-identifies information that is de-identified personal data, “the effectiveness testing conditions” means the conditions in subsections (2) and (3).
(2) The first condition is that the person acted—
(a) with a view to testing the effectiveness of the de-identification of personal data,
(b) without intending to cause, or threaten to cause, damage or distress to a person, and
(c) in the reasonable belief that, in the particular circumstances, re-identifying the information was justified as being in the public interest.
(3) The second condition is that the person notified the Commission or the controller responsible for de-identifying the personal data about the re-identification—
(a) without undue delay, and
(b) where feasible, not later than 72 hours after becoming aware of it.
(4) Where there is more than one controller responsible for de-identifying personal data, the requirement in subsection (3) is satisfied if one or more of them is notified.

---
Source: https://www.legislation.gov.uk/ukpga/2018/12/section/172 (the official version)
Page: https://openlegislation.uk/data-protection-act-2018/section-172
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.