Fable
A file without a name can still identify a person
The city archives received new rules: any paper with a name, ID number, or address had to be locked in an iron cabinet. The archivists complied, putting away customer rosters, registration forms, and complaint letters one by one.
The outer hall still kept orders, medical summaries, delivery time slots and neighborhood numbers. The librarian was quite reassured: the paper had no names and no ID numbers, so merchants could use it for statistics and apprentices for classification practice.
A few days later, the inspector picked up three sheets from the outer hall: weekly Wednesday night medicine deliveries to a certain district, a rare-disease follow-up summary, and refunds of the same amount at the same time. Without opening the iron cabinet, she could tell roughly who that customer was.
The librarian argued that the names had already been removed. The inspector arranged the papers in a line by time. Work locations, spending habits, health clues and device numbers each looked ordinary on their own, but linked together they became a person's shadow.
The director redrew the zones. Paper that could be directly named of course went into the iron cabinet; records that could identify individuals, describe behavior, or affect rights after being combined with other materials also had to be brought under management.
Merchants could still do aggregate statistics, but detailed access required stating a purpose; training materials had to be excluded, masked or aggregated; cross-table joins required approval. Librarians later often ran reverse drills: randomly pull a few sheets and see if a stable person can be pieced together. If they can, it can't be treated as ordinary material.
The hardest thing to change was everyone’s habits. In the past, people became nervous only when they saw a name; now, when they saw stable routes, rare combinations and repeatedly linkable identifiers, they also had to stop and ask: might these papers point to a certain person?
The archive did not lock away all the paper, but layered it by purpose and granularity. Aggregate what can be aggregated, mask what can be masked, and leave a reason when details must be viewed. Once people's shadows are taken seriously, the materials have room to continue being used. Later, when newcomers started, the veteran no longer began with abstract categories, but had them review that failure: where intuition had been relied on, why the first patch was insufficient, and how the new arrangement kept risk in a place that could be checked. Only when they could explain these details clearly, and also point out when to follow the old way and when to upgrade, were they considered to truly understand this approach. Later they also had newcomers practice this approach: first have newcomers do it the old way and see how errors arise; then redo it under the new rules and see which step was blocked in advance and which step left evidence. If newcomers could only recite names, they would still misuse it in similar scenarios; only those who could state the applicable boundaries, costs, and remedies after failure were allowed to take on work independently.