The re-identification risk.

An example.

« The manager, born on 3 March 1981, mother of three, living in Saint-Malo. » No name, no address. Yet very few managers were born that day in that town. The sentence holds no direct identifier, and is still personal data.

The clues that matter.

A single clue weighs little. Combinations identify.

• An exact date of birth: it narrows the population to a few people per day.
• A unique role: « the sole partner », « the director ».
• An age, a number of children, a family situation.
• A full postcode, a small town.
• A health detail, a rare profession.
• For a company: its exact figures, its founding year, a rare status.

Several clues in the same passage cross-check each other. That is where the risk rises.

What the CNIL says.

To be anonymous, a dataset must let no one single out a person, link their data together, or infer information about them. When the three tests are not fully met, you have to show that the re-identification risk is negligible. Until it is, the data stays personal, and the GDPR applies.

How Anoni points it out.

When Anoni analyses a document, the « Re-identification » panel lists the clues left once the data is masked, and groups those that cross-check in the same passage. It derives a level: « Low risk », « Medium risk » or « High risk ». The level changes each time you mask or keep a piece of data. The panel gives no number and promises nothing: « An indication, not a guarantee. Your call. » When it could not assess the document, it shows « Not assessed » rather than a low risk.

Lowering the risk.

Mask the strongest clues first: the date of birth, the unique role. Where the meaning allows, say less: a year rather than a date, a region rather than a town. Then read the document again as someone from the same circle would: they are the one who will recognise the person.