Glossary · Glossary · Risk
Re-identification: how “anonymous” data points back to people
Anonimatum Team
In short
Re-identification means attributing data that was believed to be anonymous or pseudonymised to a specific person again, usually by matching it with other sources through quasi-identifiers or contextual details.
Re-identification happens when someone works out who a supposedly anonymous record belongs to. No name is needed: a combination of traits such as age, town, occupation or a date can point to a single person and be matched against another source.
It is the risk that decides whether data is truly anonymised. Under Recital 26 of the UK GDPR and EU GDPR, anonymous information falls outside data protection law, but you must take into account all the means reasonably likely to be used to identify someone, including cost, time and available technology.
Quasi-identifiers and linkage attacks
A linkage attack joins an “anonymised” file with another one that does contain names and shares some fields. If both hold date of birth, sex and postcode, matching rows is trivial. Fields that are harmless alone but identifying together are called quasi-identifiers, and they are the reason techniques such as k-anonymity exist.
Two widely cited studies show the scale of the problem:
- Sweeney (2000) used 1990 US census data to estimate that about 87% of the US population was likely unique on just three attributes: five-digit ZIP code, sex and full date of birth.
- Rocher, Hendrickx and de Montjoye (2019), in Nature Communications, built a statistical model estimating that 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes, even when only a sample is released.
The practical lesson is not that anonymisation is impossible, but that deleting the name is almost never enough.
Singling out, linkability and inference
The Article 29 Working Party’s Opinion 05/2014 set out three tests for any anonymisation technique. They remain the reference in Europe, and the ICO’s guidance adds a complementary “motivated intruder” test: could a reasonably competent person with no specialist knowledge, but with access to public resources, identify someone?
- Singling out: can one person’s record be isolated in the dataset? The only file about a 61-year-old woman in a small village is singled out even without a name.
- Linkability: can two records about the same person be linked, within one dataset or across several? A stable pseudonymous ID reused between releases makes this easy.
- Inference: can the value of an attribute be deduced with significant probability from others? If every employee in a team received the same sanction, each person’s outcome is revealed.
In the UK, section 171 of the Data Protection Act 2018 also makes it a criminal offence to knowingly or recklessly re-identify de-identified personal data without the consent of the controller responsible, subject to specific defences.
What gives people away in documents
In judgments, reports, minutes and emails the risk sits in the narrative and in the file itself rather than in columns. These are the usual slip-ups:
| Clue | Fictitious example | What to do |
|---|---|---|
| Context and unique roles | “the head teacher of the only primary school in the village” | Generalise: “a school leader” |
| Rare events | A collision with a fire engine on 3 March | Remove or approximate the date and the unusual detail |
| Signatures and stamps | Scanned signature and a stamp with a registration number | Redact signature, stamp and verification QR codes |
| Metadata | PDF author and internal title containing the patient’s name | Strip metadata before sharing |
| Fake redaction | Black box drawn over text that can still be copied | Use redaction that deletes the underlying text |
Metadata deserves a special mention: author, organisation, revision history, comments and file names travel with a document even though nobody sees them on screen. So do hidden OCR text layers in scanned PDFs.
Reducing re-identification risk
- Decide who might attempt re-identification (a neighbour, a journalist, an employer) and what extra information they would have.
- Remove direct identifiers first, then review context: job titles, dates, places and one-off events.
- Check that redaction is irreversible and no text survives under the black boxes.
- Clean metadata, comments and tracked changes.
- If you publish the same kind of document regularly, avoid stable codes or pseudonyms that link releases together.
With Anonimatum you can redact a PDF, a Word file or an email with attachments: AI and patterns detect names, dates, addresses, amounts, digital signatures and stamps, and QR codes; you review every suggestion and apply irreversible redaction. You can also remove PDF metadata. Reviewing context still takes human judgement.
Frequently asked questions
Is re-identification the same as de-anonymisation?
In practice the terms are used interchangeably: both describe linking supposedly anonymous data back to an identified or identifiable person.
Can pseudonymised data be re-identified?
Yes, by design: whoever holds the key can reverse it, and it can also be matched with other sources. That is why the UK GDPR and EU GDPR still treat it as personal data.
Is redacting names and ID numbers in a judgment enough?
Usually not. Occupations, family relationships, places and dates can point to the person. Review the whole text and the file’s metadata.
Does re-identification risk change over time?
Yes. New public sources appear and matching techniques improve. Regulators, including the ICO, recommend reviewing risk assessments for released data periodically.
Find what gives people away in your documents
See the plans and start: detect identifiers with AI, review every match, redact irreversibly and strip metadata before you share.