Anonymization removes personal information so individuals cannot be identified from a dataset. For sensitive-data analysis, the aim is to retain what answers the business or research question without exposing the people behind the records. Fully and irreversibly anonymized data differs from data that can still be linked back to someone. section 8.3.2
Choose between anonymization and pseudonymization based on whether later identification is necessary. Pseudonymization replaces identifying details with a key or other substitute while retaining a way to reconnect records to protected information, typically stored separately. A retailer, for example, may need customer contact and payment details for purchases but not in its analytics warehouse. section 8.3.2
Table 8.1 Examples of anonymized and pseudonymized data
|
Example
|
Anonymized
|
Pseudonymized
|
|---|---|---|
|
Medical research
|
Patients have names, birthdays, and contact information removed from the data warehouse.
|
Patients have names replaced with pseudonyms and a unique identifier that can be tied to their contact information.
|
|
Human resources management
|
Employees have names, social security numbers, and birthdays masked from view.
|
Employees have all identifying information stored in a separate table with restricted access.
|
|
Customer surveys
|
Respondents have no identifying information collected.
|
Respondents can share their emails for future studies, which are only accessible by survey tool admins.
|
Compare how medical research, human resources, and customer surveys handle identifying information when records must—or need not—remain linkable. section 8.3.2
Prepare a transactions dataset
If names and phone numbers are unnecessary, drop those columns. An address can be reduced to useful geographic fields before the original address is dropped. An email can be hashed for a working dataset, but retaining a separate email-to-hash table preserves a route back to the person; do not mistake that arrangement for irreversible anonymization. section 8.3.2
Removing obvious identifiers is not enough when remaining details reveal identity in combination with other data. Movie ratings and review dates were cross-referenced with public ratings to identify people in a dataset stripped of names and emails. Before releasing records or reporting results, examine contextual clues and small groups, not just the columns labeled as personal information. section 8.3.3
Figure 8.13 An employee engagement survey with multiple breakouts can accidentally deanonymize individuals in groups with few members. For example, the sales department has one EEOC group with n=1, making it easy to identify the person and their satisfaction.
An employee-survey breakout illustrates how reporting a group with just one member can reveal an individual’s response. section 8.3.3
Collect only what a project needs, establish reporting guardrails such as minimum aggregation, and explain privacy measures to participants before research begins. Consent information should plainly describe what personal data is collected and stored, how anonymity will be maintained, and the associated storage and security practices. section 8.3.4 section 8.1.2
