MAINSYSTEMS 
identify information enabling direct or indirect identification
1. Regulatory Concept & Core Standards
In this video we will work through a concrete decision: identify information enabling direct or indirect identification. The aim is to explain the criterion used and apply it to a workplace situation. We will start with the concept, move to the procedure and finish with a case to solve. Reports can contain data about the reporter, persons concerned and bystanders. The GDPR, Estonian Personal Data Protection Act and TÕRTKS special rules govern processing. This course distinguishes lawful handling from unjustified collection, sharing and retention.
Personal data include indirect identifiers such as roles, shifts, locations and author metadata. Health and offence-related information need specific legal assessment. Replacing a name with a pseudonym does not automatically anonymise a file.
Apply the following rule: TÕRTKS section 2 covers work-related information about EU-law breaches in listed fields, including procurement, EU financial interests, data protection and EU restrictive measures. It does not automatically cover every employment dispute or corruption concern. KVS section 6 contains separate corruption-reporting protection that must be assessed on its own conditions.
2. Practical Implementation & Procedure
Map forms, attachments, logs and outputs, data subjects and purposes. Check GDPR articles 6,9 and 10 where relevant. Identify actual controller and processor roles. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.
3. Case Study & Compliance Action
A case uses an employee number, but a departmental table connects it to a name. The record remains personal data and needs access controls. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.
The exercise is as follows: Does using a number remove data-protection duties? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.
No. Identifiability through additional information still matters. Pseudonymisation can reduce risk without removing the duties.
One mistake to avoid is: treating a replacement identifier as full anonymisation.
Now apply the national rule to a second decision. A report is automatically called protected because it contains the word corruption. What check is missing?
Check the work-related connection, facts and TÕRTKS sections 2,3 and 13. Assess KVS section 6 separately where relevant. A form label does not confer every right. Identify an appropriate alternative route and limit disclosure if another procedure applies.