Why Removing Names May Not Be Enough
A dataset can omit names and still contain clues that point to particular people. Someone who knows a person’s age, neighborhood, and the date of a hospital visit might find a matching row in a released dataset. This is a form of re-identification: connecting a record that does not name a person to that person using other information.
The risk matters because records may contain sensitive details. A person’s identity can be exposed even when the dataset was prepared with the intention of protecting privacy. The central question is not only whether names have been removed, but whether the remaining information can be combined with information available elsewhere to identify someone.
A combination of indirect identifiers can be identifying even when every individual value is shared by many people. For example, many people may live in a postal area, and many may be a particular age. Far fewer may have that age, live in that area, and have had an appointment on a specific date. Information used to make such a link might come from public records, a news story, a person’s public posts, or someone’s own knowledge.
This does not mean every release of de-identified data will lead to re-identification. Risk depends on the details in the released data, the people and information an outside observer could access, and the context of release. De-identification lowers risk; it does not by itself establish that a dataset is anonymous or that identification is impossible.
Checking Whether a Combination Is Unique
A simple first check is to ask how many records share the same combination of potentially identifying values. For a record, let its matching group be the set of records that have the same values for the indirect identifiers being considered. If only one record has that combination in the released dataset, the combination is unique there. Uniqueness is a warning sign: someone with matching outside information may be able to locate that record.
The number of records in \(M(q)\) describes how many records in this dataset share the combination \(q\). A matching group of one is unique within the dataset; a larger group is less distinctive by this check. This count is not a probability that someone will be identified. It does not tell us what outside information exists or whether anyone will try to make a link.
Worked Example: Finding a Unique Combination
Suppose a fictional clinic considers releasing records without names. The table shows a record code, age, postal area, visit date, and a broad health category. An outside observer knows that a hypothetical person is 42, lives in area 02139, and visited the clinic on October 6.
| Record code | Age | Postal area | Visit date | Health category |
|---|---|---|---|---|
| R1 | 42 | 02139 | October 6 | Category A |
| R2 | 42 | 02139 | October 19 | Category B |
| R3 | 51 | 02139 | October 6 | Category A |
| R4 | 42 | 02140 | October 6 | Category C |
The observer’s information matches the combination \(q=(42,\ 02139,\ \text{October 6})\). Only R1 has all three values, so \(M(q)=\{\text{R1}\}\) and the matching group has size 1. Although no name appears in the table, the outside information can point to R1. If the health category is sensitive, the observer may then learn that the person is associated with Category A.
The values must be considered together: age 42 occurs in several records, postal area 02139 occurs in several records, and October 6 occurs in several records. It is their combination that singles out R1 in this dataset. This is a risk indicator, not proof that the person has been identified in practice; the link also depends on whether the outside information is accurate and available.
How Simple Changes Affect Matching Groups
A de-identification choice can make records less distinctive by removing a value or replacing a precise value with a broader one. Generalization turns detail into a less precise category—for example, replacing an exact age with an age band. Suppression removes a value, either for one record or throughout the release. Both can make records harder to distinguish, but can also remove information useful for analysis.
Worked Example: Generalizing Dates and Ages
Consider four fictional records. An exact age, a postal area, and a full visit date are initially available as indirect identifiers.
| Record | Age | Postal area | Visit date |
|---|---|---|---|
| A | 27 | 02138 | February 3 |
| B | 29 | 02138 | February 18 |
| C | 42 | 02139 | February 3 |
| D | 44 | 02139 | February 20 |
With all three original values, each record has a unique combination. For example, only A is age 27, in 02138, with a February 3 visit. Now suppose the release replaces ages 27 and 29 with “20–39,” ages 42 and 44 with “40–59,” postal areas 02138 and 02139 with “021**,” and all visit dates with “February.”
After these changes, A and B share the combination “20–39, 021**, February,” while C and D share “40–59, 021**, February.” Each record now has a matching group of two in this table, rather than a unique combination. The changes reduce this particular uniqueness risk, but they also hide the differences in age, area, and visit day that could matter for some analyses.
A matching group of two is not a guarantee that a person cannot be identified. Outside information could narrow the possibilities, and details not included in this simple check could also provide clues. The result only shows how the chosen transformations changed the matches within these four records.
Why Generalization Cannot Split Existing Matches
When a value is replaced with a broader category, records that formerly had the same combination still have the same broader combination. Generalization can bring previously different records together, but it does not make an existing matching group smaller, as long as the generalized values are applied consistently.
To see why, let \(q(r)\) be the original combination for record \(r\), and let \(g(q(r))\) be the combination after generalization. If two records \(r_1\) and \(r_2\) matched originally, then \(q(r_1)=q(r_2)\). Applying the same transformation to equal combinations gives:
Thus every record that matched \(r\) before generalization still matches it afterward. Other records may also join its group, so the group may grow. This justification applies to consistent generalization; it is not a claim that every possible change to a dataset increases privacy or that generalization alone prevents identification.
Assessing a De-Identification Choice
A useful assessment describes both what a change accomplishes and what uncertainty remains. For each proposed release, consider which fields are direct identifiers, which combinations could act as indirect identifiers, and what outside information could plausibly be used to make a link. Then check whether those combinations distinguish records in the released data. Finally, consider the analytical cost of changing the values.
Worked Example: Choosing What to Change
A fictional community survey contains names, exact ages, neighborhood codes, and answers about a sensitive health topic. The proposed public file removes names but leaves the other fields unchanged. In this hypothetical setting, neighborhood event listings sometimes report a person’s age and the date of a related appointment.
Step 1: Identify the concern. Names are direct identifiers, so removing them removes an obvious route to identification. Exact age, neighborhood, and an appointment-related date may still be indirect identifiers. If their combination matches one row, someone with the event information could potentially link that row to a person.
Step 2: Compare simple changes. Replacing exact ages with age bands and reducing neighborhood detail would make some combinations less distinctive. Suppressing a particularly identifying date might reduce detail further. Simply deleting names, however, does not change whether the remaining combination is unique.
Step 3: Weigh usefulness and remaining risk. Broad age bands and less detailed locations may still support some summaries, but they may not support analyses that depend on exact ages or neighborhood differences. Even if a sample check finds no unique combinations, the check does not account for every possible source of outside information. The responsible conclusion is that the proposed changes may reduce the assessed risk, not that they prove re-identification is impossible.
The appropriate choice depends on the purpose of the release and the sensitivity of the information. A more detailed file may be useful for analysis but easier to link to outside information. A less detailed file may reduce some risks while limiting what can be learned from it. Assessment should be specific about the fields and combinations examined, rather than relying on a label such as “de-identified” as a guarantee.
Common Mistakes
- “The names are gone, so nobody can be identified.” Removing direct identifiers is helpful, but combinations of indirect identifiers may still distinguish records and link them to people.
- “Each field is common, so the combination is safe.” A common age and a common neighborhood can still form a distinctive combination when paired with a precise date or another clue.
- “A matching group of two means there is a 50% chance of identification.” The group size only counts matches in the dataset. It is not an identification probability and does not account for outside information or other circumstances.
- “Generalization proves anonymity.” Generalization can enlarge matching groups for the fields examined, but it cannot rule out every possible link or guarantee that the data cannot be identified.
Check Your Understanding
Use the ideas in this tutorial to answer the following questions.
- A file omits names but includes age, occupation, and a small town. Explain why those fields might still help someone identify a record.
- In a dataset, only one record matches a particular age, postal area, and appointment date. What does that tell you, and what does it not tell you?
- Give one example of generalization and explain how it could affect matching groups.
- Why is removing a direct identifier not necessarily enough to prevent record linkage?
- A proposed change makes records less detailed. What two considerations should be discussed when assessing that choice?