How it works
Data about people can reveal identity, behavior, location, habits, and sensitive patterns even when names are removed.
Reduce risk with minimization, aggregation, access control, and careful sharing.
Common error
Removing names does not guarantee anonymity if timestamps, location, or unique combinations remain.
Worked example
Evaluate a supposedly anonymous location data set.
Data / pseudocode
Removed: student names
Retained: exact timestamps, precise location, grade
Publication: individual rowsCombinations of time and location can identify people even without names. Reduce precision, aggregate where appropriate, suppress small groups, and limit access to the information actually needed. Privacy protection must consider possible linkage with other records.
Exercises
2.4.1
Name one direct identifier and two potential indirect identifiers in a school survey.
Show solution
A name or student number is a direct identifier. A precise home location and a distinctive combination of grade, activity, and timestamp can indirectly identify a person.
2.4.2
The goal is to count total bus use by weekday. Which is the better public output: full individual trip records or weekday totals, and why?
Show solution
Weekday totals better match the stated goal while exposing less individual travel behavior. Review small groups and other release risks before publication.