What anonymisation seeks to achieve

Anonymisation aims to make people in a dataset no longer identifiable, considering means reasonably likely to be used. It differs from replacing a name with a reversible code. A statistic may appear impersonal yet still reveal individual information when it describes a small group or an event known to its recipients.

Why it affects prevention

Reports on accidents, health, exposure and wellbeing can contain sensitive information even when they present totals or percentages. Before sharing, consider who will receive them and what they know about the workplace. OSH data analytics should support decisions on measures without unnecessarily widening the distribution of individual information.

Reviewing combinations and small groups

Cross-referencing department, shift, age and injury type may leave a single person in a cell. Removing the name does not resolve that uniqueness. Treatment options include grouping categories, extending periods or removing detail, while assessing the remaining usefulness. No group size alone guarantees anonymity in every context.

Preventing reconstruction across reports

A hidden value can be inferred by subtracting subtotals or comparing successive versions. Published reports can also be combined with internal news or public information. The review should consider all outputs rather than each table in isolation. Selected techniques need assessment of residual risk and attention to changes in available information.

Disclosure example

In a hypothetical example, a company prepares a public accident report by workplace. One category corresponds to a single person and the event was publicly known. Grouping is considered to preserve preventive meaning without revealing individual detail. The decision is documented, and charts, comments and annexes are reviewed to ensure they do not reproduce the removed information.

Anonymising does not mean erasing the source

Identified records may need to be retained through a restricted process because of preventive or healthcare obligations. The dataset being shared should be assessed separately. When it cannot be established as genuinely anonymous, it continues to be treated as personal data with the corresponding safeguards, rather than using the label anonymous as an automatic exception.