6.4 De-identification is not anonymity

Removing names is often necessary, but it may not be sufficient. A combination of age, postal area, event date, occupation, diagnosis, transaction history, or another uncommon attribute can make a record recognizable. External information may also allow apparently anonymous records to be linked back to individuals or organizations.

The level of risk depends on the data, the population, the audience, and the release environment. A detailed internal table in an approved secure location may be acceptable while the same table would be inappropriate in a public presentation.

Worked Example: Managing Indirect Disclosure

A report compares service use across small regions. One region contains only two cases in a rare category. The report does not include names, but local staff may know who the two people are.

Possible responses include aggregating regions, combining categories, suppressing the small value, reporting a rate only when the denominator is sufficient, or moving the detail to a restricted internal output. The correct response depends on the applicable rules and the analytical need.