Fable
Masks and plastic surgery
There was a health archive in the west of the city. The director signed an external lending agreement that stated two things: booklets shown to temporary reviewers must mask identities, and booklets placed in the long-term research repository must never be traceable back to individuals. The director thought blacking out names, household registration numbers, and addresses would be enough.
Half a year later, the auditor came. The short-term display ledger looked fine: names were masked, and household registration numbers were masked. But the ledger in the research library made the auditor frown. He placed the redacted pages next to the neighborhood register: born in a certain year and month, living near the South Gate, occupation night-shift nurse, and having picked up medicine twice in the same week. Once the lines were combined, neighbors could easily guess who it was.
The curator then understood that masking the fields that directly name someone is just putting a mask on a person. The body shape, footsteps, and familiar relationships behind the mask are still there, and when matched with another register, the original person may still be exposed.
To enter the long-term research archive, it could not wear only a mask. The archivist began changing ages into ranges, neighborhoods into districts, and rare diseases into broad categories. Some details were kept only as statistics, with no path back to an individual.
The two processes were separated from then on: temporary display pursued usability and controllability and still had to remain in a managed environment; long-term research pursued difficulty of tracing back and preferred sacrificing some detail. The curator argued that the names were already invisible. The auditor shook his head and told him to divide the registers into two categories: temporary review only needed faces covered, while long-term archiving required dismantling the clues that could piece a person back together.
They redid the research repository: dates became ranges, addresses kept only the district, rare occupations were merged into broad categories, and medication records had details that could be linked back to individuals removed. The short-term ledger retained more business information, but was shown only to authorized people for a limited time.
Only then did the director distinguish: a mask suits brief errands, while plastic surgery suits long-term lending. The former temporarily hides identity from others; the latter must make identity hard to recognize again.
The curator later used an analogy for newcomers: masking covers up the name, while anonymization makes that row of data no longer resemble a specific person. The former can still be used under strict controls; only the latter is suitable for flowing farther and for longer.