Organisations describe data as anonymised after removing direct identifiers, then release or trade it as though identification were now impossible. What actually identifies a person in a dataset, why re-identification succeeds so reliably, and what the word would have to mean to be worth anything.
What the word is doing
In ordinary use, anonymised means the direct identifiers were removed: name, address, account number, whatever the obvious key was.
That operation is real and it is not what the word implies. It is pseudonymisation — the handle is gone and the record is intact. The structure that described a person still describes that person; it simply no longer arrives with a label attached.
The word was borrowed from a stronger idea and applied to a weaker operation, and the borrowing is doing work that the operation cannot.
What actually identifies a person
Not a name. Uniqueness.
A rough location, a date, and one unusual attribute will often narrow a population to a handful. Each further attribute narrows it again, and the narrowing compounds rather than adds — which is why the fourth and fifth fields matter far more than they look.
Most people are unremarkable in any single respect and unusual in several small ones at once. That combination is the identity, and stripping the name does not touch it.
Why re-identification works
Not through clever attacks. Through the existence of other data.
A release is never evaluated alone. It is evaluated beside everything else available, and the attack is a join: match on the attributes both sides share and carry the identity across.
The auxiliary data does not have to be secret, stolen, or expensive. Public records, professional profiles, another release from a different organisation. The strength of the protection therefore depends on what exists elsewhere, which the publisher does not control and usually has not examined.
The categories that resist it almost entirely
Location traces, because a sequence of places is close to a signature — where you sleep and where you work identify most people between them.
Medical histories, because rare things are rare, and a rare combination is rarer still.
Purchase sequences, because what was bought in what order is unusually distinctive.
Any rich behavioural record, for the property all four share: many attributes per person. Dimensionality is what defeats anonymisation, and it is exactly the property that made the data worth collecting.
What honest treatments look like
They exist, and every one of them costs something.
Aggregation with a minimum group size, so no row describes a person.
Suppression of rare values, removing the outliers that identification depends on — which also removes the people most likely to be harmed and most interesting to study.
Deliberate noise, with a stated budget, so the degradation is measured rather than assumed.
Synthetic data generated from a model, so no real record is released.
The trade nobody wants to state: a dataset that is genuinely difficult to re-identify is genuinely less useful. Claims of both at once are the claims to distrust, because the difficulty and the utility are the same property viewed from opposite ends.
The question to ask of any release
What was removed. What was kept. What is the smallest group any individual falls into.
And the one almost nobody asks: what would this need to be combined with? That question is the whole of the risk, and it cannot be answered by looking only at the release.
Why the language matters
Calling something anonymised imports a permission — ethical, often legal — that the technical operation has not earned.
The label is what allows data to be shared, sold, retained or trained on without anybody revisiting consent, because consent was understood to be unnecessary once the name came off. That is how a decision gets bypassed without anybody deciding to bypass it.
Close
Treat it as a verb describing an attempt, with a degree and a context, not as a state something has arrived at. Then ask what it was attempted against, and what it was not.