Why removing the name isn't enough: re-identification risk explained
7 min read
Removing the name is not anonymization. A record stripped of the name can still point to one specific person, because combinations of ordinary fields — ZIP code, date of birth, sex — act as a fingerprint. That gap is called re-identification risk, and it is why real anonymization has to look at fields in combination, not one column at a time.
What is re-identification risk?
Re-identification risk is the probability that someone can link a supposedly anonymous record back to the actual person it describes — by combining the remaining fields with each other or with an outside dataset (voter rolls, social media, a public review site).
The fields that make this possible are called quasi-identifiers: attributes that are not unique on their own but become identifying in combination. A birth date is shared by hundreds of thousands of people. A ZIP code is shared by thousands. But this birth date and this ZIP code and this sex, together, often describe exactly one human being.
Can you be identified without your name?
Usually, yes. The landmark evidence comes from Latanya Sweeney.
In her study “Simple Demographics Often Identify People Uniquely” (Carnegie Mellon, 2000), using 1990 US Census data, Sweeney found that 87% of the US population (about 216 million of 248 million) were likely uniquely identifiable from just three fields: 5-digit ZIP code, sex, and full date of birth.
That number is often quoted without its caveats, so two corrections matter:
- It has been re-estimated. Philippe Golle repeated the analysis on 2000 Census data (“Revisiting the Uniqueness of Simple Demographics in the US Population,” 2006) and found the share uniquely identified by {ZIP, date of birth, sex} was closer to 63% — lower than 87%, but still a majority of the population.
- It was not just theory. In 1997 Sweeney re-identified the medical record of the governor of Massachusetts, William Weld, inside a “de-identified” hospital dataset released to researchers — by cross-referencing its ZIP, birth date, and sex against publicly available voter registration records she bought for $20.
So even at the conservative estimate, a record with the name removed but the demographics intact is not anonymous for most people.
What are quasi-identifiers, and how risky is each one?
| Field removed / kept | On its own | In combination with others |
|---|---|---|
| Full name | Direct identifier — remove it | — |
| Date of birth | Shared by many | High risk with ZIP + sex |
| ZIP / postal code | Shared by thousands | High risk with birth date |
| Sex | Very low | Amplifies the two above |
| Job title + employer | Low–medium | Can single out one person in a small org |
| Rare diagnosis or condition | Medium–high | Often identifying by itself |
| Exact timestamps / locations | Low each | A trail of them is highly unique |
None of the middle-column risks looks alarming. The right column is where re-identification lives.
The cautionary cases: AOL and Netflix
Two famous data releases show that this is not a hypothetical.
- AOL (2006). AOL published ~20 million search queries from 650,000 users, with usernames replaced by numbers. The New York Times identified user 4417749 as Thelma Arnold, a 62-year-old widow in Lilburn, Georgia, purely from the content of her searches. No hacking — just reading. The identifiers were never in a “name” column; they were spread across the data itself.
- Netflix Prize (2008). Netflix released 100 million “anonymized” movie ratings. Researchers Arvind Narayanan and Vitaly Shmatikov re-identified subscribers by matching the ratings against public IMDb profiles, showing that a few known data points were enough to pick out an individual in a huge sparse dataset.
What does GDPR say about this?
GDPR Recital 26 sets the test. To decide whether data is anonymous, you must account for “all the means reasonably likely to be used” to identify the person — including linkage with other datasets, and the cost, time, and technology available.
The consequence is blunt: if the demographics or quasi-identifiers left in a record make re-identification reasonably likely, the data is still personal data and GDPR still applies — no matter how many name columns you deleted. (For the full distinction, see anonymization vs pseudonymization.)
What is k-anonymity?
k-anonymity is the standard way to measure and reduce this risk, introduced by Sweeney in 2002. A dataset is k-anonymous if every record is indistinguishable from at least k − 1 others on its quasi-identifiers.
Plainly: if you set k = 5, then for any combination of {ZIP, birth date, sex} in the data, at least 5 people share it — so a single record can’t be narrowed down to one person. You reach it by generalizing (birth year instead of birth date; a region instead of a ZIP) or suppressing (dropping outlier records). A dataset where the demographics are unique is 1-anonymous — which is to say, not anonymous.
TL;DR
- Deleting the name does not anonymize a record; quasi-identifiers re-identify people.
- Sweeney (2000): 87% of the US population was uniquely identifiable from {ZIP, birth date, sex}; Golle’s 2000-Census re-estimate put it near 63% — still most people.
- Real cases (AOL, Netflix) re-identified individuals from “anonymized” releases.
- GDPR Recital 26 counts “all means reasonably likely to be used” — so re-identifiable data is still personal data.
- k-anonymity is the fix: make each record blend into at least k − 1 others.
Before and after: a record that’s still identifiable
Before (“raw”):
Name: Anna Nowak — DOB: 1987-03-14 — Postal code: 30-002 — Sex: F — Diagnosis: rare autoimmune condition
After naive find-and-replace (name removed):
Name: [REDACTED] — DOB: 1987-03-14 — Postal code: 30-002 — Sex: F — Diagnosis: rare autoimmune condition
The name is gone, but the record is not anonymous. {Postal code + date of birth + sex} may describe a single resident of that postcode — and the rare diagnosis narrows it further. Cross-referenced with any external list, this is one person. This is exactly the failure mode Sweeney demonstrated.
FAQ
Is data anonymous once I remove names and ID numbers? Not necessarily. If the remaining fields — postal code, date of birth, sex, job, a rare attribute — allow re-identification when combined or linked to other sources, the data is still personal data under GDPR Recital 26.
What is a quasi-identifier? A field that is not unique on its own but becomes identifying in combination with others. ZIP code, birth date, and sex are the classic trio.
Is the 87% figure still accurate? It comes from Sweeney’s analysis of 1990 US Census data. A 2000-Census re-estimate by Golle found roughly 63% for the same three fields. Both show that a majority of people are uniquely identifiable — the exact percentage depends on the dataset and year.
How do I actually reduce re-identification risk? Treat identification as a property of the whole record, not one column. Generalize or suppress quasi-identifiers until each record shares its combination with several others (k-anonymity), and mask indirect identifiers, not just names.
Where Amaze fits
Naive find-and-replace deletes the name and calls it done. Amaze is built for the real problem: it detects and masks personal data — names (including Polish names across grammatical cases), emails, phone numbers, addresses, and Polish identifiers like PESEL, NIP, REGON, and KRS — so the quasi-identifiers that actually re-identify people don’t slip through. And it runs locally, on your own machine, before any text reaches an AI model.
For the wider vocabulary, see data masking vs anonymization vs pseudonymization.
Primary sources in one place: Is your data really anonymous? collects Recital 26, the 87% study, and k-anonymity with citations.
Part of our complete guide to data anonymization.