[Feature]: Incoporate EU pseudonymization guideline

[snichols001]

Contact Details

steven.nichols@gehealthcare.com

Is your feature request related to a problem? Please describe.

pseudonymization guideline from the EU:

https://www.edpb.europa.eu/system/files/2025-01/edpb_guidelines_202501_pseudonymisation_en.pdf

Describe the solution you'd like

No response

Describe alternatives you've considered

No response

Additional context

No response

Code of Conduct

• I agree to follow the IHE Code of Conduct

[alan-zhang-22]

The most precise blocker to incorporating the EDPB Guidelines 01/2025 into this handbook is a structural mismatch in the scope of pseudonymization itself. This handbook, following ISO 25237, defines pseudonymization as a process that acts on direct identifiers — replacing them with pseudonyms to preserve record linkage while removing explicit identity. Treatment of quasi-identifiers is a separate, complementary step governed by generalization, suppression, or statistical privacy models such as k-anonymity. The EDPB Guidelines, by contrast, define pseudonymization as a risk-based processing mode whose validity is judged by a single criterion: whether the full record, considering both direct and quasi-identifiers together, can still be attributed to a data subject by actors within the defined pseudonymization domain. Under this framing, quasi-identifier treatment is not a parallel activity — it is an intrinsic sub-step of the pseudonymizing transformation itself (§84, §3.1.3.2). As a result, data that qualifies as pseudonymized under the handbook's technical definition may not satisfy the EDPB standard if residual quasi-identifiers remain exploitable within the processing context. Aligning the two would require dismantling the handbook's separation between pseudonymization and quasi-identifier techniques — a reorganization that would conflict with the jurisdiction-neutral, technique-oriented architecture the handbook is built on, and would impose GDPR-specific legal constructs (controller obligations, pseudonymization domain, Art. 4(5) compliance) onto a framework intentionally designed to apply across HIPAA, PIPL, ISO, and NIST contexts.