Data anonymization.

The definition.

The GDPR describes anonymization in its recital 26: its rules do not apply to information that no longer relates to an identified or identifiable person, taking into account all the means reasonably likely to be used to identify them. The French CNIL puts it shorter: anonymization makes any identification impossible, by any means, and irreversibly.

Anonymizing is not pseudonymizing.

Replacing « Claire Fontaine » with « Person 1 » or with a fake name is pseudonymization. The data is still personal: a mapping table, or a simple cross-check, leads back to the person. The GDPR defines pseudonymization in its article 4 and always treats it as personal data.

The three tests.

European data protection authorities, and the CNIL after them, use three criteria. A dataset that meets all three is presumed anonymous.

• Singling out: you can no longer isolate a person.
• Linkability: you can no longer link separate datasets about the same person.
• Inference: you can no longer deduce, with near certainty, information about a person.

When the three are not fully met, you have to show that the risk of re-identification is negligible.

The two families of techniques.

They apply first to datasets, once direct identifiers are gone: name, address, phone number, social security number, IBAN.

• Randomization: values are made less exact while the overall distribution is kept. Noise added to an age, values swapped between rows. It mostly protects against inference.
• Generalization: the scale changes so that a value is shared by several people. A date of birth becomes a year, a town becomes a region. k-anonymity is its measured form: each combination of values must appear for at least k people.

What it means on a document.

A contract, a report or a letter is not a table: you cannot generalize a sentence. You remove the direct identifiers, then look at what is left. A date of birth, a unique job title, a town, a number of children: these are what re-identify. A redacted document is only anonymous if those clues are gone too.

What Anoni does, and what it does not.

Anoni finds the personal data in a French document, on your computer. It removes it for good (redaction) or replaces it reversibly (pseudonymization). The « Re-identification » panel points out the clues that remain, with a risk level. Anoni does not decide for you that a document is anonymous: the panel says so itself, « An indication, not a guarantee. Your call. » For a data file, CSV or SQLite database, it works column by column.