Pseudonymity: what counts as personally identifiable data?

Below are examples of data that could be used by a partner to identify a Learner and an explanation of why it will not be linked to the learner_id.

Data that could be used to identify a learner includes:

• Name

• FutureLearn profile name

• Photo of the person

• An identification number (including public FutureLearn Profile ID or a University ID)

• Location data (a general location may be acceptable depending on other data collected)

• An online identifier (including IP address, email address or a name used on a social network)

• One or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of an individual (for example, job role, company or organisation, ethnicity, disability).

When evaluating the potential of the data to identify a learner, consider information requested directly as well as information that may be tracked ‘behind the scenes’ (for example, IP address and location). Also consider how data can be used in aggregate; can multiple pieces of data be used to identify a learner (across one or more linked datasets)?

Although learner_id is designed to be pseudonymous, the user linked to that ID may reveal personally identifiable information in their comments, at which point the learner_id becomes personal data, and as such must be handled according to the GDPR. Under our privacy policy, we have informed learners that our partners may use their learner_id, including comments containing personal data, for research purposes. In those instances, however, partners are obliged to not identify the individual by finding the actual comment on the FutureLearn website and seeing the user associated with such comment.