Fable
Every sheet of paper may point to a person
The port service station used to treat only names and ID numbers as privacy. Other receipts, chat records, locations, device numbers, and purchasing habits were all treated as ordinary business materials. The counter staff often said: this doesn't have a full name on it, so it's nothing serious.
The station launched a document assistant that could aggregate customer letters, customer service records, and contracts. It quickly learned to piece fragments into a complete customer profile. The stationmaster was delighted at first, feeling he could finally see clearly what customers needed.
Once an assistant generated a report. No name appeared, yet it wrote "the night-shift nurse who lives at South Pier, complained about cold chain last week, and uses a certain model of equipment." Colleagues knew at a glance who it was. The report did not leak the name, but it had already pointed the person out.
The stationmaster first required names to be masked. But the combination of location, occupation, time and behavior in the report could still be linked to an identifiable natural person. Someone else suggested masking only ID numbers, but the problem did not disappear, because device numbers, order trajectories and complaint content linked together could still trace the person back.
They reclassified the data: anything that could be linked to an individual, alone or in combination with other information, was treated as personal data. In classification they looked not only at field names, but also at usage scenarios, combinable materials and information already in the recipient's hands.
Before the document assistant calls data, it first judges the purpose and legal basis, trims displayed fields by role, and the duty log also avoids storing identifiable combinations. Business did not stop; it was just that each document was no longer casually copied into the public register, passed to an outside document box, or taken out of the port just because it "had no name."
The service station finally accepted a broader definition: any information that can point to a person must be treated as personal data. A name is only the most obvious signpost; many small paths together can also lead to the same person's door.
Later, whenever the station made a new form, they would ask one question: does this piece of data alone point to a person, does it point to a person when combined with other data, and does it become easier to point to a person once handed to an outsider. After asking these three questions, many fields that had been collected casually simply disappeared.