Pseudonymization

The theater troupe kept preference records for every audience member. The old ledger contained real names, seat numbers, purchase records and comments, and anyone who opened it could see complete identities. After the troupe brought in the ticket-recommending puppet, the ledger was copied to many workstations. The better the puppet got at recommending, the wider the real names circulated. The troupe leader first replaced real names with "Guest One, Two, Three." But the substitution table was tucked into the same ledger, and any clerk could instantly restore them.

An outside lamp repairer got the ledger and replacement table, and although there was no malice, he saw all the preferences of the valued guests.

The new accountant split the materials into two books: the work ledger kept only random numbers and business characteristics, while the identity key was locked separately and kept by a small number of people according to process.

The ticket-recommendation puppet uses only numbered practice and service; when it needs to contact the audience, the entire device is authorized to temporarily use a key to restore it, and a record is left afterward.

This did not make the data anonymous, because the key still exists. But it significantly reduced the chance of exposing real identities during daily processing.

The troupe leader finally distinguished: pseudonymization keeps identity and business data stored separately, reducing the risk of direct attribution; as long as the key still exists, it remains personal data.

Later the troupe wanted to make joint recommendations to out-of-town theaters. The out-of-town theaters only received the work ledger, and could see that a certain type of audience preferred tragedies or comedies, but could not see their real names and addresses in the city. If tickets were to be mailed, the local bookkeeping office had to make contact on their behalf.

One clerk found it troublesome and wanted to copy the key too. The new accountant refused: convenience is not a reason; the more keys there are, the more the pseudonym looks like thin paper. The troupe leader therefore set thresholds, time limits, and rechecks for borrowing keys, ensuring the two separate ledgers would not stick back together in daily life. They also regularly checked whether the keys were still necessary, and contact lists that should not be kept long-term were destroyed on schedule. After the split, daily use became lighter and accountability clearer. If one day a key is no longer needed, it should be recalled, not left lying in a drawer waiting for an accident. The troupe leader wrote this into the troupe rules, lest convenience quietly swallow the boundary.