Re-identification: why removing names is not enough

Removing names is not enough because people are recognised by combinations of ordinary details. A date of birth, a postcode and a job title can point to one person with no name on the page. To protect someone, you must blur those details too. How far you go depends on the reader.

What is a quasi-identifier?

A quasi-identifier names nobody by itself but narrows down who it is. In 2000, Latanya Sweeney, then at Carnegie Mellon University, defined it as a set of data elements that, combined, match one person uniquely or almost uniquely. The GDPR (EU) agrees: under Article 4(1), a person can be identified directly or indirectly. In documents, look for:

• Date of birth, age, or the exact date of an event: hired, admitted, dismissed.
• Postcode, town, site, school, hospital.
• Job title, grade or team, above all when one person holds the role.
• Rare events: a long sick leave, an accident, a lawsuit, an award.

Take a complaint about Jane Example. You black out her name. The text still says: the payroll manager of the Leeds office, 52, back from sick leave on 3 March. That office has one payroll manager, and everyone knows who was away. The name was never needed.

What does the research on re-identification show?

The classic study is Sweeney's Simple Demographics Often Identify People Uniquely (2000). Using 1990 US census data, she found that 87% of the US population, 216 million of 248 million people, were likely unique on three fields: 5-digit ZIP code, gender and date of birth. With the city instead of the ZIP code, it was still 53%.

In 2019, Rocher, Hendrickx and de Montjoye estimated in Nature Communications that 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes. In 2013, de Montjoye and colleagues showed that four points in place and time uniquely identify 95% of 1.5 million phone users. And a letter says far more about one person than a table row.

What are the three risks: singling out, linkability and inference?

In Opinion 05/2014, the Article 29 Working Party, the EU regulators' group before the EDPB, stressed that identification does not only mean finding a name or an address. It named three risks.

• Singling out: can a reader isolate one person? The only woman on the night shift is singled out, name or no name.
• Linkability: can a reader link the text to another record about the same person? A dismissal date matches a public profile. The UK regulator, the ICO, calls this the mosaic or jigsaw effect.
• Inference: can a reader deduce something new with significant probability? One of three accountants is seriously ill, says the memo. Two of them just ran a marathon.

The EDPB is updating this text. On 7 July 2026 it adopted Guidelines 02/2026 on Anonymisation, open for public consultation until 30 October 2026. Its three tests are no record isolation, no linkage and no inference. As of September 2026, the text is not final.

Which details in a document give people away?

A US rule shows the level of care. Under the HIPAA Safe Harbor method for health data (45 CFR 164.514), dates tied to a person are cut down to the year. Only the first three digits of a ZIP code may stay, and only if that area holds more than 20,000 people. It is a yardstick, not a standard for EU documents.

What should you mask for each audience?

The ICO draws a line. With public release you lose control of the data, so the approach must be very robust. With a defined group, you look at what that group already knows. Its example: an employee may work out that a particular absence statistic relates to a colleague.

The insider is the hard case. Against a colleague, removing the name does almost nothing: the context is the identifier. Does the team need the case, or only its lesson? For an AI tool, consistent labels such as [NAME1] keep the text readable. That is pseudonymisation: whoever holds the original can still make the link.

How do you test a document before you send it?

1. Name your reader, and list what this reader already knows or can look up in ten minutes.
2. Read the masked copy as a motivated intruder, the ICO's test: a competent person with the internet and public documents. Try to name the person.
3. Search the web for the rarest phrase, title or event left in the text.
4. Generalise what still points to one person. Delete what the reader does not need.
5. Check the file: no text under the bars, no metadata. Keep the original safe.

Software helps with the first layer. Pattern-based tools find names, emails, phone numbers, addresses, ID numbers and dates. ONYRI Sanitize, for example, does this inside the browser, without uploading the file, and lets you add your own terms to mask. But job titles and rare events are ordinary words. No detector knows that the Leeds office has one payroll manager. You spot that yourself in the preview. Masking reduces exposure. It does not by itself make a document anonymous.

Frequently asked questions

Sources & references