Anonymisation

What anonymisation means

Anonymisation removes any reference to a person so that it cannot be restored even with additional knowledge. The decisive addition is the extra knowledge. Deleting a name is not enough if date of birth, postal code and profession together describe only one person. Such a record remains personal data, even without a name.

Legally that has an important consequence: encrypted or pseudonymised data remains personal data and falls under data protection. Anonymised data does not. Only anonymisation removes the data from the scope of the regulation, and that is why it is so sought after.

How it differs from pseudonymisation

Pseudonymisation replaces the name with an identifier and stores the mapping separately. The record is therefore no longer directly attributable to a person, but for the controller with access to the mapping it still is. The difference is not technical but legal: pseudonymised data remains personal data.

This is often misunderstood. Anyone swapping names for numbers and keeping the list has implemented a security measure and not anonymisation. The data may still only be processed with a legal basis.

Which methods are used

• Removal: direct attributes such as name and address fall away. That is the first step and never enough alone.
• Generalisation: instead of an exact date of birth the year remains, instead of the address the district. The group size rises, the attribution becomes uncertain.
• Noise: values are slightly changed so individual records become blurred while the sum stays right.
• Swapping: attributes are exchanged between records so no record is fully correct while the distribution is preserved.
• Aggregation: only group values are stored, no individual cases.

Why it is difficult in practice

The first point is combinations. A record that looks unremarkable alone can be unique in combination. Every anonymisation therefore needs a check of how many records still stand alone after treatment.

The second point is additional data. Anyone keeping the customer database can reverse some anonymisation when the method rests on a single attribute. The third point is repeated processing. If new records are published regularly and the methods are the same, differences between versions can be evaluated. The fourth point is the definition. Some parties speak of anonymisation while meaning pseudonymisation. Anyone who does not know the difference treats a method as safe that is not.

In practice only one approach remains: choose the method, check group sizes, consider additional data and document the result. Anyone who has to justify it later needs that record.

Frequent questions

• Is deleting the name enough? No. Further attributes can describe a person. Basics are covered under GDPR.
• Can anonymisation be reversed? An effective one cannot. An ineffective one only appears to be.
• Do I need it for analyses? Yes, when data is to be analysed or passed on without an individual reference.