Use cases
Use cases: anonymizing documents to meet the law
Real situations where an organisation has to disclose, publish or reuse documents containing personal data, with the applicable UK, US and EU rules and a workflow to handle them.
Use case
Sharing health data for research and secondary use
Health data is special category data under the GDPR and protected health information under HIPAA. Research use relies on safeguards: pseudonymised data under strict controls, or data de-identified to a standard you can document.
ReadAdministrative case files: give access without exposing third parties
People involved in a case can usually see their file, and courts receive the record, but case files are full of other people's data. The key is removing or pseudonymising it consistently across every document.
ReadPublic procurement: transparency without exposing bidders' people or secrets
Procurement law demands transparency about tenders and awards, but bids contain CVs, signatures, ID numbers and trade secrets. UK and US rules let you withhold what is sensitive without hiding the whole bid.
ReadHandling subject access requests while protecting third parties
A subject access request (DSAR) must normally be answered within one month with a copy of the requester's data, but that copy must not adversely affect other people. The answer is to disclose everything and redact only what belongs to others.
ReadFreedom of information: release records while protecting personal data
FOI laws favour disclosure, but third-party personal data is protected: section 40 in the UK, exemptions 6 and 7(C) in the US. The usual answer is partial release, with the personal details redacted and the rest disclosed.
Read