Anonymising is not blacking out the name: what the GDPR really requires

A document is considered anonymised when it no longer leads to the person by any reasonable route, not when the name has been removed. The reference standard in Europe boils down to 3 questions, and the idea is to be able to answer no to all of them: whether a specific individual can be isolated, whether the document can be cross-referenced with another source that does identify them, and whether it can be deduced who is being talked about from what is left in writing. As long as one of them remains open, the data is considered still personal.

The brief that looks anonymised and is not

Picture a claim for damages arising from a road accident. Before sharing it, someone at the firm has run the black marker over the client’s name and over the other driver’s. At first glance, the job is done.

But the brief still contains the claimant’s ID number, their address, the bar registration number of the other side’s lawyer, the court, the case number and the date of the accident, which the local paper covered the next day with a photo of the roundabout.

Ask yourself a simple question: how many of those pieces do you need to know who this is about?

With the ID number you need none at all. It is a direct identifier, and blacking out the name next to it is like covering the signature and leaving the fingerprint. Without the ID number, 2 will usually do. The date and place of the accident lead to the news story, and the story names those involved. The address and the court narrow the circle to a handful of people. The bar registration number identifies the opposing lawyer, who is also a person with their own data, and tells you which firm is handling the matter.

None of that is a name. And yet the document still says who it is talking about. That is the most common misunderstanding: thinking that anonymising consists of removing the word that identifies, when the criteria used to assess it look at something else: whether any route to the person remains.

The 3 criteria you have to pass

A reference document in Europe for assessing anonymisation is opinion 05/2014 on anonymisation techniques by the Article 29 Working Party. The opinion sets out its criteria for datasets, but transposed to a brief they can be summed up in 3 questions. You do not need to study it to apply them: it is enough to ask them of each document.

Singling out: can I isolate someone?

Singling out means being able to distinguish a specific person within a group, even without knowing their name. The name is not needed: it is enough for the description to fit one person only.

In an employment file, «the only worker on the night shift at the Girona site» names nobody and yet points at someone. Anyone who knows the workforce knows who is being discussed. The same goes for «the company’s sole director» or «the partner who joined the year of the merger»: these are positions, not names, and each one points to a person.

Linkability: can I cross-reference it with another source?

The second criterion asks whether the document can be linked to another dataset that does identify. The risk lies not in what your brief says on its own, but in what it says when placed next to another source.

An unusual settlement figure, or an accident date that appeared in a local outlet, make it possible to cross-reference the document with a public source that does identify the person. Neither is a name, and both work as a cross-reference: they lead from the document to a place where the identity does appear.

Inference: can I deduce who it is?

Inferring means reaching the person, or information about them, by deduction from what remains in writing. This is where the details nobody blacks out come in, because they do not look like personal data.

An uncommon profession in a small town, the age and the neighbourhood, the description of a rare illness. None identifies on its own, and combined with what is known about the surroundings they may be enough to deduce who is being talked about.

The 3 criteria work together: passing 2 is not enough if the third remains open. And the yardstick is not that identifying someone should be impossible. Recital 26 of the GDPR speaks of the means reasonably likely to be used to identify a person, taking account of factors such as cost, the time required and the technology available.

Why it is harder in the legal field than elsewhere

In other sectors, anonymising usually means removing columns from a table: the name, the phone number, the email address. A legal document does not work like that.

A brief is made of identifiers that cannot be removed without destroying it: the court, the case number, the procedural dates, the applicable rule, the references to other briefs in the same matter. If they are all removed, what is left is no longer a brief but a text without context that does not serve the purpose it was needed for. And many of those elements point to public registers, which is exactly the door that linkability opens.

There is a second difficulty, less visible. A case file is not one document: it is many. The claim, the defence, the expert reports, the emails with the client, the invoices, the documentary evidence. Having 40 documents is no rarity in a matter of any size.

Anonymising them one by one, without a common criterion, creates a new problem. If the same person appears as «client A» in the claim, as «the claimant» in the expert report and with their initials in an email, the relationships between the documents are lost. You no longer know that the witness in the report is the person who signed the invoice. The material ends up protected, but it has stopped serving what it was wanted for, which is almost always working with the matter as a whole.

That is why there is little sense in preparing, marker in hand, the documentation you are about to upload to a general-purpose tool. Before doing it with a client’s documents, it is worth knowing what actually happens to what you send.

No anonymisation is perfect, and that has to be said

The Spanish Data Protection Agency starts from that idea in its guidance on anonymisation procedures: advances in technology and the information available make absolute anonymity difficult to guarantee, especially over time. It therefore frames the risk of re-identification as a residual risk to be managed, and not as something that can be taken as eliminated.

The «over time» part matters. What identifies nobody today may identify someone tomorrow, when a new source to cross-reference it against appears or a story is published that did not exist before.

Nor is there a technique that solves everything. Replacing the direct identifiers does not protect against inference, and generalising the dates does not protect against a case number left in the text. Opinion 05/2014 puts it this way: the solution is decided case by case and may involve combining several techniques. The Agency’s guidance adds the idea of anonymising in layers, through successive processes, so that re-identification would require getting past all of them.

And there is the uncomfortable trade-off that is rarely discussed: the more aggressively you anonymise, the less useful the document. The Agency’s own guidance includes among its principles that of preserving the utility of anonymised data. If everything is blacked out, the text no longer holds together, and whatever you get from working with it will be no use either. The goal is not to black out as much as possible, but to protect what identifies and keep what gives the document meaning.

It is worth spelling this out: anyone promising perfect, 100% anonymisation is selling something.

What you can do with a document before uploading it anywhere

This checklist can be applied today, by hand, to any document before it leaves the firm. It is no substitute for a full procedure, but it forces you to look exactly where the data nobody sees tends to stay.

• Direct identifiers. ID numbers, tax numbers, social security numbers, IBAN, vehicle registration. They are the most obvious and they still slip through, above all in annexes, headers and footers.
• Indirect identifiers almost nobody looks at. Bar registration number, land registry reference, policy number. They do not look like personal data, but each one leads to a specific person.
• Singular dates. The date of an accident, a dismissal or an operation makes it possible to cross-reference the document with the press or with a register. If the exact day is not essential, the month or the year may be enough.
• References to publicly reported proceedings. Case, appeal or decision numbers that can be searched in public repositories.
• Descriptions of facts that already circulated. If the matter appeared in the media, the account of the facts may identify on its own, even with no other personal data left.
• The closing question. With the document in front of you: is there anything left that allows singling out, linking or inferring? If any answer is yes, the prudent course is not to treat the document as anonymised.

And before all of that, one question that saves work: does the whole document need to be sent? This is the idea of the minimisation principle in article 5.1.c of the GDPR: data limited to what is necessary for the purposes for which they are processed. What you do not send, you do not have to anonymise.

If you would rather go through it with one of your own documents in front of you, get in touch.

Sources

• Opinion 05/2014 on anonymisation techniques (WP216), adopted on 10 April 2014 — Article 29 Working Party
• Guidance and safeguards in personal data anonymisation procedures — Spanish Data Protection Agency
• Regulation (EU) 2016/679 (GDPR), recital 26 and articles 4.1, 4.5, 5.1.c and 32.1.a