Fable
Shredding the list and changing names
The city hospital's records room has a patient list with names, ID numbers, medical histories, and medication records. The hospital wants to conduct a retrospective study and needs to hand this list to a university research team.
Old Tang the archivist had two ways of handling things. The first: completely delete names and ID numbers from the list, even shredding the original cross-reference table. The second: replace names with codes "P001" and "P002," then lock up a cross-reference book that only Old Tang had the key to.
Old Tang felt the two approaches were about the same—after all, the research team could not see real names in the data they received either way. He chose the second, because if the research results ever required notifying patients, he could still use the key to open the cabinet and match the numbers. The research team received the coded data and successfully published the paper.
Half a year later, a hospital information security audit. The auditor pointed at the numbered dataset and asked: Is the cross-reference table still in your cabinet? Old Tang said yes. The auditor wrote a line in the report: This dataset is pseudonymized data, contains re-identification potential, still constitutes personal data, and is subject to data protection regulations.
Old Tang panicked: I replaced all the names with numbers, so how is this still personal data? The auditor explained: the standard for anonymization is whether anyone can still map the data back to a specific person. Simply deleting names is far from enough. Your cross-reference book is still in the cabinet, so you still have the ability to turn numbers back into real names, and this data is not legally anonymous.
Old Tang went to check the original legal text and found that the law's requirements for "anonymization" were far higher than he had imagined—not only must direct identifiers be removed, but the combination of indirect identifiers must also be assessed for whether it could lead to re-identification. "Pseudonymization," by contrast, only requires replacing direct identifiers and allows a mapping table to be retained; legally it still counts as personal data, merely a technical means of reducing risk.
Old Tang went back and revised his data processing workflow. For any data that needed to be legally "anonymous," he destroyed the entire original list and the cross-reference table, leaving no recovery path. For data that needed follow-up, he used a pseudonymization process, but clearly labeled it: this dataset is pseudonymized data, the cross-reference table is stored in the archive room safe, accessible only by the administrator.
Later, in the hospital's data compliance training, Old Tang placed a shredder and a safe side by side on the podium. He said: data behind the shredder is no longer your legal responsibility. Data behind the safe is still your responsibility, only with less risk.