Just saying:

> ‘It an offence for a person knowingly or recklessly to re-identify information that is de-identified personal data without the consent of the controller responsible for de-identifying the personal data’ … ‘personal data is “de-identified” if it has been processed in such a manner that it can no longer be attributed, without more, to a specific data subject.’ … for the purposes of the re-identification offence, the DPA 2018 refers to ‘de-identified’ personal data as personal data that has undergone pseudonymisation as defined in the UK GDPR rather than (for example) anonymous information.

See:

https://ico.org.uk/media/about-the-ico/consultations/2619862/anonymisation-intro-and-first-chapter.pdf

And:

https://www.legislation.gov.uk/ukpga/2018/12/section/171