Engineering, production, governance, cost, communication · insight-1284
Count rows that are unique on indirect identifiers before releasing a table
- Evidence type
- documented fact
- Difficulty
- medium
- Roles
- Data analyst, Data scientist, ML engineer
- Industries
- healthcare, public-sector, cross-industry
Summary: situation, action, reason, boundary
Situation
An extract with names and ids removed, but birth date, postcode and gender intact, is to be shared with a partner for research (hypothetical).
Action
Treat combinations of indirect identifiers as quasi-identifiers, compute group sizes on the combination, generalise (age band, truncated postcode) or suppress until every combination appears at least k times (k agreed with the privacy owner), then re-run the count.
Reason
A release is k-anonymous when each person is indistinguishable from at least k-1 others on the identifying fields, and linking de-identified fields to identified sources is the route to re-identification.
Boundary
Extracts shared outside the team, public dashboards with small cells, research data sets.
Symptom or risk
Those columns can be linked to an identified list, so individuals are re-identified even though no direct identifier is present.
Exceptions
k-anonymity alone is not enough: groups sharing one sensitive value still disclose it, and the original paper discusses attacks that work unless policies are followed.
Trade-offs
Generalising loses analytic detail; larger k costs more utility.
Pitfalls
Checking each column's uniqueness alone instead of the combination.
Example
Hypothetical: 40,000 rows, 9,200 distinct combinations of birth month, postcode and gender; 3,100 combinations occur once and must be generalised or suppressed before release at k = 5.
Lessons and concepts
Claims and their sources
Sweeney defines k-anonymity as each released person being indistinguishable from at least k-1 others, and describes linking de-identified fields to identified information to re-identify individuals.