Making sense of data legislation

Southampton IT law expert helps organisations comply with data protection regulations while finding ways to innovate with anonymisation.

Published: 8 February 2022

The General Data Protection Regulation (GDPR) came into force in May 2018. It changed the way we use data in the UK and EU. Data controllers and processors can be fined for breaches and non-compliance.

Understanding the legal implications

IT law and data governance researcher, Professor Dr Sophie Stalla-Bourdillon at Southampton, examines what this means for businesses and individuals.

“I’m trying to see to what extent GDPR changes practice, and whether it meets the needs of individuals – or ‘data subjects’ – and people working with data. I’m also working to understand new opportunities or to what extent GDPR imposes more constraints on the way we deal with data.”

Personal data must be processed for a specific reason, lawfully and transparently. It must be used with consent of the data subject and must not be held for longer than needed.

This change is better for individuals because we now have:

the choice to ‘opt in’, rather than ‘opt out’ of company privacy policies
the right to have our information removed from company records

The implications for organisations is that they need to make sure governance structures are in place to comply with the legislation.

Creating opportunities with anonymisation

Working with data using techniques like anonymisation or pseudonymisation can also present valuable opportunities. Anonymisation removes information that can identify an individual person in a data set and pseudonymisation replaces it.

Sophie is studying how these approaches can be used:

“I’m trying to understand what anonymisation is - when you can speak about anonymised data and when you can’t - and what the implication of this spectrum of personal, pseudonymised and anonymised data is.”

Sophie’s work will help companies understand when they are dealing with personal data, and when they are outside of the scope of the GDPR.

Sophie again:

“We want to gather data sets from data providers, and then offer start-ups and innovators the option to use these data sets to innovate, and come up with solutions to specific challenges we're facing.”

Connecting organisations working with data

Southampton is also leading Data Pitch – an international innovation programme working to connect organisations with subject matter experts and start-ups working with data.

The Data Pitch team are investigating how data can be used to solve problems across different industries including: