Re-identification of anonymised data

What it is

Anonymous data falls outside data protection law, which makes anonymisation attractive for training and sharing. True anonymity is hard to achieve. Removing names leaves patterns, such as a combination of postcode, age and occupation, or a distinctive writing style, that can single a person out. Models are good at exactly this kind of matching, and the amount of other data available for linking keeps growing. The risk is that data handled as anonymous is in fact pseudonymous, and is treated with less care than it requires.

How it happens

• Direct identifiers are removed and rare combinations of attributes remain.
• Free text keeps details that identify its author or subject.
• A dataset is joined with another that restores the link.
• A model is asked to work out who a record describes.

Why it matters

If people can be identified, every data protection duty applies, and the organisation has been operating without them. Data shared or published on the footing that it was anonymous cannot be recalled.

Warning signs

• Anonymisation consisted of deleting name and account number.
• No test of re-identification was attempted.
• The dataset contains free text.
• Anonymised data has been shared outside the organisation.