Section 172 Re-identification: effectiveness testing conditionsI1

(1)

For the purposes of section 171, in relation to a person who re-identifies information that is de-identified personal data, “the effectiveness testing conditions” means the conditions in subsections (2) and (3).

(2)

The first condition is that the person acted—

(a)

with a view to testing the effectiveness of the de-identification of personal data,

(b)

without intending to cause, or threaten to cause, damage or distress to a person, and

(c)

in the reasonable belief that, in the particular circumstances, re-identifying the information was justified as being in the public interest.

(3)

The second condition is that the person notified the F1Commission or the controller responsible for de-identifying the personal data about the re-identification—

(a)

without undue delay, and

(b)

where feasible, not later than 72 hours after becoming aware of it.

(4)

Where there is more than one controller responsible for de-identifying personal data, the requirement in subsection (3) is satisfied if one or more of them is notified.

Annotations

Textual amendments

F1: Word in s. 172(3) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)

Commencement

I1: S. 172 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)

Notes on Part 6

Modifications

C1: Pt. 6 applied in part (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 406 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g) (with reg. 4); and as amended (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 105, 142(1); S.I. 2026/82, reg. 2(u); and (30.9.2026) by S.I. 2026/386, reg. 1(2), Sch. 3 para. 19(3)(c); S.I. 2026/1015, reg. 2(c))
C2: Pts. 5-7 applied in part (with modifications) (5.2.2026) by S.I. 2003/2426, reg. 31, Sch. 1 (as substituted by Data (Use and Access) Act 2025 (c. 18), ss. 115(5)(8), 142(1), Sch. 13; S.I. 2026/82, reg. 2(y)(z14) (with regs. 8-11) and as amended (30.9.2026) by S.I. 2026/386, reg. 1(2), Sch. 3 para. 6(3), (4)(j); S.I. 2026/1015, reg. 2(c))