Five Fields One Person

A research release drops name and email from a health dataset but keeps exact birth date, five digit ZIP code, sex, and diagnosis. The team labels the export anonymized and puts it outside the privacy program. What is wrong with that call?

The release becomes anonymous once a random per-row identifier replaces the implicit row ordering that the source table carried into the export

Birth date, ZIP, and sex together single out individuals through linkage, so the export is pseudonymized personal data until it is generalized to a k-anonymity threshold

Removing the direct identifiers is enough for anonymization, but the release still needs a data processing agreement signed with every recipient institution before the files are transferred

The quasi-identifiers become safe once the ZIP code is hashed with a secret salt that is never shared with any recipient of the release or written into the export