This is important. Yes, re-identification of de-identified brain MRIs is possible, but it is considered to be a crime under GDPR, implemented as “data protection” laws in EU (each country made their own laws and legal consequences).
Pseudo-anonymisation assumes that it is “highly unlikely” to re-identify the data. This means that for those cases in which it becomes trivial to reidentify a subject (eg rare case study subject), special care is needed and it should be the ethical committee with the researcher..
...to decide on benefit for science/society vs potential harm to the individual. Also: I believe that sensitive data can still be shared on a per request basis as done by human connectome project or ADNI, but legislators have still to finish their job as these relate...
... to those parts of the GDPR where each country can make special amendments. So in the end, it’s always a case by case decision. Nobody forces us to share data, but we understand that our data can help science if we also allow others to reuse it (openly or after requesting)
