Beyond that, what exactly is this "statistical use" when compared to raw personal data? There was a CNS standard, the one you just mentioned, CNS 29100, that says after a certain de-identification process, then we can use the results because it has minimal privacy impact for statistical use, instead of raw data.