An HR team shares an anonymised summary of a grievance procedure with the leadership team. The names are gone. What remains: an employee in procurement, joined in 2019, who had a conversation in March about a restructuring decision.
Procurement has fourteen people. Three joined in 2019. One of them had that conversation in March.
No name appears in the document, and everyone at the table knows who it is about.
Two kinds of identifying data
Direct identifiers point to one person on their own: name, national insurance number, email address, employee number, phone number. Easy to recognise, and almost always removed when anonymising.
Quasi-identifiers say nothing alone and everything together. Postcode, date of birth, gender, job title, department, years of service, education level, the date of an event. Each of those fits thousands of people. Three of them together frequently fit one.
The classic research here is Latanya Sweeney's, showing that postcode, date of birth and gender together uniquely identify the large majority of the US population. She demonstrated it by locating a governor's record inside a supposedly anonymised medical dataset.
Why it goes faster inside organisations
That research covered an entire country. Within an organisation the mechanism is identical and far more efficient, because the group is smaller.
"A team lead in the northern region" is meaningless in a national dataset. Inside a company with three regions and twelve team leads it points at four people. Add "since last year" and it is one.
On top of which, readers hold prior knowledge. An external researcher has only the document. A colleague knows who had a meeting in March, who was on parental leave, and who was the only person on that project. That prior knowledge is not a dataset and works as a key.
Which is why re-identifiability is not a property of a document but of a document plus an audience. See also anonymising, pseudonymising, masking.
The underrated fields
Three categories that almost always survive because they look harmless.
Dates. The date of an absence, a meeting, a decision or an incident. To the reader, often a direct pointer to one event and therefore one person.
Numbers that are unique in a small group. An amount, a length of service, a score, a customer number left in because it "is not personal data".
Descriptions of events. "The employee who ran last year's tender" is not a name and it is a pointer that exactly one person matches.
How to assess it
Not by looking at fields, but at combinations, and always against an audience.
- Who reads this? An external audience with no prior knowledge is a different situation from a leadership team that knows the people.
- How large is the group this person comes from? In a team of twelve, nearly every attribute is an identifier.
- Which combinations remain? Take the surviving fields and ask how many people match. If the answer is under five, it is not anonymous.
- Can it be more general? An age band instead of a date of birth. A quarter instead of a date. "An employee" instead of a job title.
Step four is the real work, and it costs substance. That is the trade-off anonymising carries: the less identifiable, the less useful. Leave it implicit and you make the choice anyway, usually in the wrong direction.
Why this weighs more with AI tools
With a document shared internally, the audience is known and can be reasoned about.
With an AI tool you do not know. The text goes to a service that may retrieve more around it, into a conversation that persists, under a retention period you do not set. The combination of fields that was just about acceptable internally now sits in a context you cannot see.
The practical rule that follows is pleasantly simple: remove what the task does not need, and then the question of whether it is "anonymous enough" stops needing an answer. Rewriting a summary works without the department, without the years of service and without the date. Then you never have to do the arithmetic.
