How to anonymize a case study without destroying its value

Release context

An audience change can turn the same paragraph into a different risk

Write the release instruction before touching the case. Name the purpose, expected recipient, channel, access conditions, geographic reach, indexing status, onward-sharing expectation and review date. A paragraph supplied to a named procurement team under stated confidentiality is not the same release as a permanent public web page. The ICO guidance distinguishes open release from limited access because controls around a known recipient can reduce some routes to identification and misuse. Those controls do not repair weak anonymization, but they change the available disclosure design.

Specify what the case must prove. It may need to demonstrate recovery of a public-service backlog, operation across multiple sites, work with vulnerable residents or a measurable improvement under a fixed staffing level. This proposition becomes the utility test later. Details that do not help the evaluator test it are candidates for removal. Details that carry the proposition need a more careful choice: preserve them, generalize them without changing meaning, or decide that this case cannot safely serve this release.

The worked example concerns the fictional Merewick Service Partnership. It wants to use a customer case in a bid for a regional contact-centre contract. The source case names a council partnership, gives a go-live week, lists 11 service lines, reports a backlog of 18,742 contacts after a well-publicized outage and records a 41 percent reduction in median waiting time over 14 weeks. The buyer needs evidence of backlog recovery and controlled measurement. The exact outage, contact count and dates also make the customer easy to locate through public committee papers. The release record therefore treats the buyer-only tender answer and any later public article as separate decisions.

Do not begin by promising anonymity. In European data protection law, anonymous information and pseudonymised personal data have different consequences. Customer confidentiality and trade-secret duties can also protect information about a legal entity even where no person is identifiable. The reviewer should state which concern is being controlled: personal identification, customer identity, contractual secrecy, commercially sensitive method, implied endorsement or several of them. One label cannot decide all of those questions.

Source case

The safe version starts from a complete record, not a damaged old brochure

Collect the source case under restricted access. Record the contracting and delivery entities, relevant people, service users or groups, statement of work, delivery period, locations, technologies, partners, incidents, baseline, intervention, result, measurement rules and source links. Add the customer permissions, NDA terms, internal classification and any previous release. A marketing page or earlier proposal can help locate evidence, but it is not the evidence. Its approval may have expired or covered another audience.

Split the case into claims before anonymizing it. Merewick creates separate records for the starting backlog, incoming demand, staffing boundary, triage change, clearance period and median waiting-time result. Each record states the unit, population, dates, exclusions, data owner and Merewick contribution. That separation matters because a privacy edit to one field must not silently alter another claim. If the 18,742 contacts become “more than 15,000,” the internal crosswalk must show why that lower bound is supported and which comparisons still work.

Record authority separately from truth. A service report may prove that waiting time changed, but it does not grant permission to publish the customer’s identity. An account owner may approve relationship language but cannot certify the metric calculation. A privacy reviewer can assess identification risk without owning the contractual release. The final decision needs the roles required by the organization’s policy. AN-123 addresses whether an unnamed example is acceptable for the buyer’s evidence request; this release record begins after a case has been selected and focuses on how its disclosure is transformed.

Keep an immutable or versioned copy of the source artefacts. Anonymization should create a derivative, not overwrite the material needed to prove what happened. Limit access to the crosswalk that connects released values to originals. Pseudonymisation can be a useful control for that working record, but EDPB and ICO guidance make the important point that information remains personal when additional information can reconnect it to a person. Calling a restricted customer key anonymous would obscure the very access and security duties that protect it.

• Keep the original evidence, transformation log and release copy as distinct objects.
• Give every quantitative statement its own denominator, period and source owner.
• Record customer, partner and supplier work without awarding all credit to one party.
• Separate factual validation, disclosure permission and final release authority.
• Protect the identity crosswalk at least as carefully as the underlying case material.

Clue register

A rare combination exposes more than a visible name

Inventory direct identifiers first: legal and trading names, personal names, logos, domains, addresses, account numbers, contract references, faces, voices and unique identifiers. Then move to quasi-identifiers and narrative clues. These include a narrow sector, small region, exact event date, site count, distinctive technology, unusual job title, procurement route, partner combination, exact financial value, public incident and memorable quotation. A field can look harmless by itself and become decisive beside three others.

Classify what each clue can expose. The customer organization is one subject. Named or inferable employees, complainants, service users and partner staff are separate subjects. The fact that Merewick helped a council partnership may not be personal data on its own, while a sentence about the only safeguarding lead who managed the outage can point to a natural person. Trade-secret and contractual analysis also remains relevant after personal clues have gone. A complete register does not force the same legal label onto every subject.

Read the whole publication package. Searchable text is only one layer. Review diagrams, testimonial fragments, map shapes, UI captures, alt text, captions, footnotes, revision history, comments, hidden spreadsheet tabs, chart data, embedded thumbnails, filenames and document properties. The National Archives redaction toolkit warns that electronic redaction must remove information rather than merely cover it. Exported PDFs deserve an extraction and copy-paste test, and images need checks for cropped content and metadata.

Merewick finds no customer name in the draft, yet the heading says “eleven statutory lines restored after the May service outage.” An infographic retains an exact 18,742 count. The PDF author property names a council communications officer. A linked job advertisement from the same period mentions the triage product. Any one clue leaves several candidates; together they isolate one organization. All four enter the same combination group in the register.

Linkage model

Test against what the recipient can combine, not an empty internet

Define realistic recipients. For a tender, they may include procurement staff, operational evaluators, an incumbent supplier and advisers who know the local market. For a public page, include customer employees, journalists, competitors, search engines and people affected by the service. Record their likely background knowledge and the sources available with reasonable time, cost and skill. GDPR Recital 26 frames identifiability around means reasonably likely to be used, and the ICO suggests a motivated-intruder test as a practical starting point.

Build search scenarios from the clue register without using confidential source text in uncontrolled services. Try combinations such as sector plus incident month, region plus service-line count, outcome phrase plus technology category, or contract value plus partner. Check official award notices, public meeting papers, press releases, customer reports, supplier announcements, job adverts, conference presentations and previous versions of your own case. Record the query, source date, result and confidence. An unproductive search is evidence of that attempt, not proof that identification is impossible.

Consider singling out, linkage and inference separately. Singling out asks whether the release isolates one customer or person. Linkage asks whether it can be connected with another record. Inference asks whether the case reveals protected information once the match is made, such as an unreported security weakness, complaint level or health-related service. WP29 and CNIL use these distinctions for personal data. They also form a useful practical attack model for customer confidentiality, provided the reviewer does not mistake it for a legal conclusion about organizations.

The buyer for Merewick already knows which regional partnerships suffered major contact backlogs because its operations team reviewed peer performance reports. A general web reader may not. The buyer-only version therefore needs stricter treatment of the outage and service configuration, even though it has access controls. Conversely, open publication creates indefinite onward access and future linkage. The record preserves both analyses instead of assigning one universal risk score to the paragraph.

Transformation

Change the clues that carry the least proof first

Rank each clue by identification contribution and decision value. Remove direct identifiers with no evidentiary purpose. Suppress distinctive colour, quotations and incident labels. Generalize geography only as far as the operating context still matters. Replace an exact date with a period when recency, rather than the calendar day, is relevant. Aggregate service lines into a supported category. Express scale as a defensible band or threshold derived from the source. Document the rule before writing the released value.

Generalization cannot become fabrication. If the source customer operated in one English region, “UK public sector” may be true but less useful; “several European authorities” is false. If 18,742 contacts are documented, “more than 15,000” is supported, while “about 20,000” needs an agreed rounding convention and may overstate. Date shifting can be suitable in some research datasets, but silently moving a project’s month in a narrative creates a false delivery record. Suppress or label a transformation rather than presenting a made-up date as history.

Protect exact results by reducing surrounding clues when the result is central. Merewick keeps the 41 percent median waiting-time reduction because the calculation and comparison period are verified and the buyer’s question asks for measured recovery. It changes the exact backlog to “more than 15,000 contacts,” describes the service as a “multi-service regional public contact operation,” removes the outage month and names the intervention as routing and daily capacity control rather than the proprietary tool. The internal log retains every mapping.

Do not create composites unless the text is explicitly an aggregate and its method is valid. Combining one customer’s scale, another’s method and a third customer’s result produces an engagement that never happened. It cannot serve as past-performance evidence. Synthetic examples have legitimate educational uses when clearly marked, as this article’s Merewick example is, but they must not be presented to an evaluator as customer experience.

Utility test

The released case must still support the sentence an evaluator reads

Run a source trace after transformation. For each sentence, record the source claim, transformation, released claim and allowed inference. Confirm the actor, service boundary, period, population, baseline, measure, result and supplier contribution. A privacy edit that changes “median waiting time” to “response times,” for example, broadens the metric. Removing the word median may make the claim sound like every contact improved. The safer wording has become less accurate, so it fails the proof test.

Check semantic and quantitative containment. A category must include the source fact without implying other members. A range must contain the documented value and follow a stable rule. An aggregate must be recalculated from eligible records rather than guessed from the original. Qualitative substitutions need equal care. “Implemented capacity controls” cannot replace evidence that Merewick advised the customer but did not operate the controls. Anonymization does not permit promotion of the supplier’s role.

Give a reviewer only the released case and the buyer criterion. Ask what they believe about sector, scale, problem, method, result, causation and repeatability. Compare those inferences with the source record. If the reader now believes the 41 percent change applies to mean handling time, all regions or a permanent operating state, the wording needs repair even if every literal fragment came from a source. Advertising regulators assess implied messages as well as express claims, which is a useful discipline for proposal evidence.

Merewick’s final buyer-only statement says that it supported a regional public-service contact operation with a documented backlog above 15,000 contacts, introduced routing and daily capacity controls, and observed a 41 percent reduction in median waiting time over the verified 14-week comparison. It adds that the customer retained staffing and policy authority. This version preserves the decision-relevant scale, intervention, statistic, period and role. It does not preserve the customer identity, exact backlog, outage date or product name.

• Reject any released sentence whose source cannot be located without relying on the deleted identity.
• Keep statistical labels, populations and comparison periods beside a retained number.
• Test what a fresh reader infers, not only whether each word is literally true.
• Downgrade or remove the case when relevance disappears after safe transformation.
• Keep named-reference and customer-endorsement requirements on separate approval paths.

Artifact inspection

A clean paragraph inside a revealing file is not a clean release

Create release copies from controlled source files. Accept changes, remove comments, inspect headers and footers, delete hidden rows and slides, flatten or remove layers where appropriate, and clear document properties that are not needed. Test redactions by selecting, copying, searching and extracting text. Open exported images separately. Check whether chart data, accessibility descriptions, hyperlinks and embedded objects contain the original name. Do not assume a black rectangle destroyed the text underneath it.

Inspect filenames, paths and link destinations. “CouncilName_case_final.pdf” defeats careful body editing. A hyperlink whose visible label says “customer report” may still contain the customer domain. Download URLs, analytics titles, content-management slugs and image asset names can be indexed. CNIL guidance on data management specifically notes that metadata can aid re-identification and should be limited when unnecessary. The same practical concern applies when metadata identifies an organization or employee rather than a data subject.

Compare the case with adjacent bid material. A CV may name the same unusual project, a partner page may give the missing location, and a pricing note may identify the contract. Search the assembled response for distinctive dates, counts, role titles and phrases from the clue register. The combination visible to the recipient is the unit of review. A case is not protected merely because each document owner reviewed a separate file.

Generate a checksum or another controlled identifier for the approved output and store it with the release record. The purpose is to distinguish the tested file from later edits, not to claim that a checksum provides confidentiality. If a writer changes a chart, alt text or result after approval, the output returns to evidence and disclosure review. Distribution should use the approved derivative, never the restricted working file.

Challenge test

A second reviewer should try to identify the case before a real recipient does

Choose a reviewer who did not perform the transformation and give them the planned release context. Define permitted methods and a time box that reflect a realistic recipient. For sensitive cases, use someone with disclosure-control or privacy expertise. The reviewer searches the declared sources, tests combinations, inspects artefacts and records candidate matches. They should not access the identity crosswalk until their attempt is complete. The exercise measures a stated scenario; it does not certify anonymity for every future actor.

Record the strongest candidate, the clues that produced it, confidence, effort and what protected information would be exposed if the match were correct. A weak match can still matter where consequences are severe. Conversely, a plausible organizational match does not automatically identify a person. Keep probability and consequence separate. NIST SP 800-188 recommends measurable release standards, governance and re-identification studies for government datasets. A narrative case is smaller than a dataset, but the discipline of explicit performance criteria and independent review transfers well.

Merewick’s reviewer finds three plausible organizations from the public-service description. Adding the exact 14-week window and the retained result narrows the set to two, but neither source independently confirms the intervention. The buyer’s background knowledge may produce a stronger match, so the record does not classify the customer as impossible to identify. It records limited-release risk, the contractual controls, the absence of personal incident detail, the proof value retained and the authorized decision owner.

Set a decision vocabulary before results arrive: release approved, release with limits, further transformation required, named permission required, alternate case required, evidence no longer useful, or release prohibited. Avoid a single numeric risk score that averages away one decisive clue. If customer permission covers the exact use, record it, but do not stop the test. Permission from an organization may not cover personal data, third-party secrets, misleading claims or reuse outside the agreed channel.

Approval and review

Approval expires when the audience, evidence or outside information changes

Bind the decision to the exact text, media, filenames and distribution route. Record factual reviewer, account or customer authority, privacy or legal reviewer where required, and the person authorized to release. Include approval date, expiry, territory, languages, named recipient class, indexing status and whether excerpts are permitted. Store the reason for the decision and unresolved assumptions. A general “case approved” flag is too weak because it loses the conditions that made the decision acceptable.

Set reopen triggers. Review the case when a new public award notice, customer report, incident disclosure or supplier announcement adds a linkage source; when a metric is corrected; when the customer changes name; when a new language adds distinctive phrasing; when the audience widens; when search indexing is enabled; or when the customer changes permission. Guidance from CNIL, ICO and HHS all recognizes that available information and technical capability change over time. Past review supports history, not permanent safety.

Monitor released copies within the organization’s control. Keep a distribution register for limited releases, and maintain a route to replace or withdraw web content. If identification occurs, stop planned reuse, preserve the release and evidence records, assess whether personal data or contractual information was exposed, notify the responsible specialists and follow the applicable incident process. A public correction must preserve the record needed to understand what happened.

The completed Merewick record authorizes the buyer-only wording for one procurement and forbids transfer to the public case-study library. It names the checked PDF, stores the transformation and linkage-test records, and requires a new decision if another buyer receives the text. The useful result is not a claim of perfect anonymity. It is an inspectable choice that preserves the evidence the evaluator needs while making the remaining exposure, controls and authority visible to the people responsible for release.