Section 171: re-identifying data is a crime in the UK
Few people know it, but in the UK it's a criminal offence to knowingly or recklessly re-identify de-identified personal data without the controller's consent.
What the law says
Section 171(1): re-identifying de-identified personal data without consent is an offence.
Section 171(5): so is knowingly processing data that has been re-identified.
Section 172: allows testing whether de-identification works, under conditions.
How s.171 fits into a licence
Why it matters for sellers
It adds a legal backstop to the contract. Our licences restate the bar on re-identification and require deletion on request.
Key takeaways
Re-identification without consent is an offence.
Contracts should say so explicitly.
It's a backstop, not a substitute for proper de-identification.
