The processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. Such additional information must bekept separately and subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.