What is anonymization? Definition, methods and examples

The definition of anonymization under the GDPR

The GDPR does not define anonymization in its article 4, but it sets out its effects in recital 26: the principles of data protection do not apply to anonymous information, namely information that does not relate to an identified or identifiable person, or to personal data rendered anonymous in such a way that the person is no longer identifiable. To decide, the text asks you to take into account all the means reasonably likely to be used, considering the cost, the time required and the technology available.

European data protection authorities set out their reference analysis in Opinion 05/2014 on anonymisation techniques, adopted by the Article 29 Working Party (now the European Data Protection Board, EDPB). Anonymization there means making identification impossible in practice, by any means and irreversibly. Three criteria let you check the result:

• singling out: it is no longer possible to isolate one person in the dataset;
• linkability: it is no longer possible to link these data to other data about the same person;
• inference: it is no longer possible to deduce new information about a person with near certainty.

Two consequences follow. First, anonymization is assessed case by case, according to what the recipient knows: a document that is anonymous to an outside reader may still identify someone to a colleague of that person. Second, it is irreversible: if a table makes it possible to find the names again, the data are pseudonymized and remain personal data. The relevant texts are gathered on the page regulations.

Anonymization methods: randomization and generalization

Opinion 05/2014 sorts anonymization techniques into two broad families, often combined. National authorities such as the French CNIL still use this classification.

These techniques were designed for databases. For a document (contract, minutes, letter, report), the approach comes down to four actions:

1. delete direct identifiers: name, address, email, phone number, social security number, IBAN;
2. mask them with a neutral label, such as [PERSONNE] or [ADRESSE], when the mention must remain visible;
3. generalize indirect identifiers: age rather than date of birth, region rather than address, "a manager in the department" rather than the exact job title;
4. check hidden content (metadata, comments, revision history) and review the result against the three criteria.

Replacing a name with a stable alias, such as PERSONNE_001, is not anonymization in itself: it is pseudonymization, useful and legitimate, but reversible as long as the correspondence exists somewhere. It becomes a step towards anonymization only if the table is destroyed, or never created, and if indirect identifiers have also been dealt with.

Examples of anonymization that worked and anonymization that failed

• An employment contract template. HR removes the employee's name, address and social security number, replaces the salary with a band and the job title with a generic role. The template can circulate without pointing to anyone.
• A clinical case for teaching. The report loses the patient's identity, but also the town, the admission date and the occupation, which would be enough to recognize the patient in a small hospital.
• Court decisions released as open data. In France, the names of the natural persons who are parties or third parties are removed before release, and other identifying details may be removed too when disclosing them would endanger the safety or privacy of the people involved.

Conversely, a famous case shows the limits of superficial anonymization. In 2006, AOL published millions of search queries in which each user was replaced by a simple number. Journalists from the New York Times nevertheless identified one of these users from the content of her searches: names of places, shops, relatives. The number was a pseudonym; the content still identified her.

Biffer helps you apply these principles on your computer, offline. The software detects direct identifiers and the fields specific to 18 professions, lets you choose for each type of data whether to pseudonymize, mask or keep it, and clears the metadata. Without a mapping table, and once indirect identifiers have been handled, the document comes close to anonymization; the final review is yours. The page anonymize a document explains these settings.