How to anonymize a document

Anonymize or pseudonymize: the GDPR framework

The GDPR distinguishes two operations. Pseudonymization, defined in article 4, replaces identifying data so that they can no longer be attributed to a person without additional information, kept separately. Anonymization goes further: it makes identification impossible, taking into account "all the means reasonably likely to be used" (recital 26).

To assess the result, European authorities rely on the three criteria of Opinion 05/2014 on anonymisation techniques, adopted by the Article 29 Working Party, the group of European authorities that has since become the European Data Protection Board:

• singling out: it must not be possible to isolate one person in the document;
• linkability: it must not be possible to link this document to other data about the same person;
• inference: it must not be possible to deduce new information about a person with near certainty.

In practice, a contract in which the employee's name becomes PERSONNE_001, with a table that lets you recover that name, is pseudonymized. The same contract, with no table, no date of birth or address, and no detail that would let someone recognize the employee within the company, comes close to anonymization. Pseudonymization can be reversed, anonymization cannot. Both approaches are legitimate and meet different needs: the first serves when you must put the real values back into a result, the second when the document leaves for good.

How to anonymize a document in five steps

The following procedure applies to a single document as well as to a series of files of the same kind.

1. List the direct identifiers: surnames, first names, emails, phone numbers, addresses, social security numbers, IBANs, company numbers, tax numbers, case and contract numbers, license plates.
2. Spot the indirect identifiers. A study by Latanya Sweeney (Carnegie Mellon University, 2000) showed that the combination of ZIP code, sex and date of birth was enough to uniquely identify 87% of the US population (original study). Dates, places, job titles and rare events therefore deserve the same attention as names.
3. Choose a treatment for each type of data: delete, replace with a label ([PERSONNE]), replace with a stable alias (PERSONNE_001) or generalize, for example a date of birth reduced to the year, an address reduced to the region.
4. Deal with hidden content: metadata, comments, tracked changes, headers, footers, text sitting under a black shape.
5. Test for re-identification: reread the document as a colleague of the person concerned would, and check the three criteria.

The last step is often neglected, yet the quality of the whole job depends on it. It means asking yourself who could recognize the person, and with what additional information. A patient file without a name may remain identifiable in a small hospital ward if the age, admission date and town still appear in the text. In that case, generalize or delete these details, then reread again.

Anonymize a Word, PDF or Excel document with Biffer

Each format has its traps. In Word, data hide in comments, revision history and file properties; Microsoft Word's Inspect Document feature helps remove them. In a PDF, text is split into positioned objects, and a rectangle drawn on top removes nothing; a scanned PDF contains only an image, which must first be read by character recognition. In Excel, the same person appears on hundreds of rows, which makes manual processing slow and error-prone, especially when names are typed with variants.

We developed Biffer to apply the five-step method to these three formats, as well as CSV and text files, directly on your computer:

• local detection of direct identifiers and of the fields specific to 18 professions;
• a highlighted preview where you untick a false positive or add something missed, applied to all occurrences;
• stable aliases (PERSONNE_001), masks or black-out, chosen for each type of data;
• metadata cleared, and scans handled by built-in character recognition;
• an optional encrypted mapping table: with it, you pseudonymize; without it, you come close to anonymization.

Biffer makes the review step easier without replacing it: you remain the judge of whether the result is anonymous. The page anonymize a document details the policy choices, the page features describes the full workflow, and the page regulations gathers the applicable texts.