Contact

GlossaryPublic records, privacy, and data quality

De-identification

De-identification reduces links between records and people. Understand why removing names or masking a location does not guarantee anonymity.

De-identification is the process of reducing or removing the connection between data and the people it describes. For government records, the aim is to preserve useful information while limiting the risk of identifying someone. The method matters: removing names alone does not establish that a dataset is anonymous.

What changes in a public version

The National Institute of Standards and Technology describes approaches that remove identifiers, change potentially identifying details, or produce synthetic data. It emphasizes assessing disclosure risks and notes that tools which merely mask personal information may not provide sufficient de-identification. NIST SP 800-188.

Synthetic data is generated using a model of the source data. Its individual rows should not be treated as records of actual incidents.

A public-safety release might therefore contain broader locations or less precise dates than the agency's internal record. Readers should know which details were changed so they do not mistake a privacy measure for an exact observation.

Example

Hypothetical: An agency prepares a public table of service calls. It removes personal names, replaces exact addresses with service areas, and groups timestamps by day. The resulting table can help describe daily workload by area.

It cannot support an exact-address map or a minute-by-minute timeline because those details are no longer present. The changes also do not prove that every identification risk has been eliminated. A responsible release decision would consider the remaining combinations of information and the intended access arrangement.

Common confusion

Redaction usually describes removing or obscuring particular information. De-identification describes the broader effort to reduce a record's connection to an individual. Redaction may be one part of that effort, but the two terms are not interchangeable.

Replacing a name with a code also leaves a question: can the code or other fields reconnect the record to a person? The label “de-identified” is most useful when the publisher explains the approach and its limits, rather than presenting it as an absolute guarantee.

How privacy choices affect interpretation

Read the release notes before using detailed locations, times, or categories. If an address is generalized to a block or area, describe it at that level. If small values are withheld, keep them separate from zero.

Privacy protections can limit which questions a public dataset can answer. A table may be useful for understanding overall demand while being unsuitable for investigating a specific individual's experience. That is a boundary on the analysis, not a reason to reconstruct details the publisher intentionally removed.

An informative source note explains the type of transformation without disclosing protected information or suggesting that the public data retains its original precision.

Sources