When personal data is no longer needed, most businesses assume deletion is the only option. Under Australian Privacy Law, there is another: de-identification.
Understanding what it means, how it works and when to use it is more practical than most businesses realise. And for businesses sitting on large volumes of historical data they are not sure what to do with, it opens up options that deletion alone does not.
Definition
De-identification is the process of removing or altering the identifying elements of personal data so that an individual can no longer be reasonably identified from it. Under the Australian Privacy Act, de-identified data is no longer considered personal information, meaning the same privacy obligations no longer apply to it.
What De-identification Isn’t
It is not simply removing a name from a record. True de-identification requires removing or altering all information that could be used, alone or in combination with other available data, to identify an individual.
A dataset that looks de-identified in isolation may become re-identifiable when combined with publicly available information. The test under Australian privacy law is whether an individual could reasonably be identified, not whether obvious identifiers have been removed.
De-identification vs Pseudonymisation
Pseudonymisation is often grouped with de-identification but they are not the same thing. Pseudonymisation replaces identifying information with an artificial identifier, but the process is reversible. Where the mapping between the pseudonym and the original identifier exists, the individual can be re-identified.
Pseudonymised data is still considered personal information under Australian privacy law and carries the same obligations as any other personal data.
How Does De-Identification Work?
De-identification is not a single technique but a range of approaches that can be applied depending on the nature of the data and the purpose it still needs to serve.
The goal in each case is the same: to reduce the likelihood that an individual can be identified from the data, either directly or in combination with other available information.
Common Techniques
- Data masking: identifying values within a dataset are replaced with fictional but structurally realistic alternatives. A customer’s name might be replaced with a different name, or an account number replaced with a randomly generated equivalent. The format and structure of the data is preserved, but the individual it relates to is removed.
- Tokenisation: identifying data is replaced with a randomly generated token. The original data is stored separately in a secure system, with the token acting as a reference. The token itself carries no meaning and cannot be used to identify the individual without access to the secure mapping system.
- Generalisation: specific values are replaced with broader categories that reduce identifiability without removing the data’s analytical value. An exact date of birth might become an age range. A precise residential address might become a suburb or postcode.
- Aggregation: individual data points are combined into group-level statistics, removing the ability to identify any single individual from the result. Rather than individual customer records, the data might show average spend across a demographic group or total transactions within a region.
Choosing the Right Technique
The appropriate technique depends on what the data needs to do after de-identification. Where the data only needs to support aggregate analysis or reporting, generalisation or aggregation may be sufficient. Where individual-level records still need to be tracked or matched over time, tokenisation may be more suitable.
Pseudonymisation remains an option where re-identification may be necessary but must be governed accordingly.
Risks and Challenges
De-identification reduces privacy risk but does not eliminate it entirely. Several challenges are worth understanding before relying on it as a primary approach to managing personal data.
Re-identification Risk
The most significant challenge is the risk of re-identification. Even data that appears de-identified in isolation may become re-identifiable when combined with other datasets or publicly available information. This risk is particularly acute for small datasets, where the combination of seemingly innocuous attributes, age range, occupation, postcode, may be sufficient to identify an individual.
Assessing re-identification risk requires consideration not only of the data itself but of what auxiliary information exists or may become available in the future.
Managing the Risk
Managing that risk may therefore require more than de-identification techniques alone. Additional controls and safeguards can help reduce the likelihood of re-identification, including:
- Access controls: limiting who can access de-identified data and under what conditions, including user authentication and data encryption
- Controlled environments: restricting data analysis to secure environments where raw data cannot be extracted or combined with external sources
- Aggregate outputs only: providing only the results of analysis rather than access to the underlying de-identified dataset
- Ongoing review: regularly reassessing whether de-identified data remains sufficiently de-identified as new information becomes available
When to Delete and When to De-Identify
The right choice depends on what the data still needs to do.
When to Delete
Delete when the data is no longer needed for any purpose, when a valid erasure request has been made and no lawful retention ground applies, or when the retention period, has expired and there is no ongoing need for the information.
When to De-Identify
De-identify when the data still has analytical or operational value but does not need to identify individuals. Historical reporting, trend analysis, research and benchmarking are all legitimate uses for de-identified data. Once properly de-identified, it can be retained and used without the obligations that come with holding personal information.
Starting With What You Hold
Neither approach works in isolation. Knowing which data to delete and which to de-identify requires knowing what data the business holds and why it holds it. Without that clarity, both deletion and de-identification become guesswork.
De-identification is a useful and legitimate tool in a business’s privacy toolkit. But it only works as part of a broader approach to data governance, one that starts with understanding what personal data exists, where it lives and what purpose it still serves.
Every business is different. The right approach to data governance depends on your specific circumstances, systems and obligations.
