Anonymity means preventing an individual’s identity from being linked to their data or actions. Removing obvious identifiers does not guarantee anonymity when other attributes or content enable reidentification. section 8.3.3
Protect anonymity in sensitive analytics by:
- Collecting responses anonymously and avoiding reports of individual records. section 8.3.3
- Synthesizing qualitative comments into themes instead of sharing responses that may reveal writing style or circumstances. section 8.3.3
- Suppressing subgroup results below a minimum aggregation level of five and limiting breakouts for consistently small groups. section 8.3.3
Employee engagement reporting
A nonprofit’s HR analytics team reports survey results by department, office, tenure, and gender, but withholds results for groups smaller than five. It also avoids multiple breakouts where small teams could make an individual identifiable. section 8.3.3
Figure 8.13 An employee engagement survey with multiple breakouts can accidentally deanonymize individuals in groups with few members. For example, the sales department has one EEOC group with n=1, making it easy to identify the person and their satisfaction.
Shows how intersecting demographic breakouts can expose an individual in a subgroup with one member. section 8.3.3
