Data anonymization

Before research data can be published in open access, all direct personal identifiers must be removed from the data, such as names of individuals, addresses, telephone numbers and ID numbers. The data also needs to be assessed with regard to the presence of indirect personal identifiers, as such information, either alone or in conjunction with other variables, convey risk for exposing the identities of individuals. Examples of indirect identifiers are unusual or specialized job titles, rare religious beliefs and membership in small groups or associations. The greater number of indirect identifiers in the data, the greater the risk for disclosure, and the need for taking action (e.g., deleting certain variables, erasing or encrypting information).

Assessment of disclosure risk

Typically assessment of risk for personal disclosure involves a systematic examination of all variables. Needless to say, this is especially important when data covers sensitive topics, such as health status, illegal activity, or other sensitive information. One common criteria is that if a response category is endorsed by less than 20 individuals, the variable should be examined in more detail. Disclosure risk analysis can involve conducting frequency analyses of variables to determine low-frequency responses and extreme outliers. This should always be complemented with qualitative analysis of risk characteristics based on local knowledge of field work, its design and the population and individuals studied.

Example: A study of workers' attitudes and only one woman is employed at the workplace. 

Example: Age and marital status are not obvious personal identities, but what if one participant is 18 years of age and divorced?

Free-text information (string variables)

You also need to check carefully the free-text answers of participants, for example in string variables. These may include information that, at first glance, may not seem harmful, but can be used to trace answers back to individuals, in a direct or indirect way.

Example: An individual says he has been on the town council for the last few years.

Example: An unusually high number of square meters of a private house in a sparsely populated town.

Measures to reduce disclosure risk in scientific data

As mentioned earlier, direct personal identifiers must always be removed before data can be published, whether the data will be made available using an open or restricted access protocol. In addition, the data must be analyzed thoroughly with regard to indirect identifiers, which can also lead to the exposure of individuals. The table below provides an overview of methods that can be used to reduce the risk of disclosure due to direct and indirect personal identifiers in research data.