Before You Call AI Data Anonymous

The draft considers the means reasonably likely to be used to identify someone, including context and available information. It does not demand the elimination of every theoretical possibility. Nor do contracts and access controls, by themselves, establish anonymity. Its discussion of evolving technology includes AI's potential to reduce identification effort; that is not a measured failure rate for corporate datasets. ²

The Board's October overview also warns against choosing the wrong perspective when one organisation processes information for another. A supplier's lack of a name is not necessarily the deciding fact. The overview simplifies draft guidance; it is not a substitute for the full analysis or qualified advice on the particular arrangement. ³

Imagine a company removes names from customer-service records before asking an AI supplier to identify recurring problems. The remaining text includes unusual events, dates or locations. Another party might hold information that makes some records easier to connect to a person. This is an illustration of a question to investigate, not evidence that this dataset—or every similar dataset—can be re-identified.

The useful management question is not whether a colleague can recognise a row at first glance. It is whether the evidence used to approve the project covers the actual parties, purpose and access arrangements. A change of recipient, an added data source or a broader use should prompt someone to check whether the earlier reasoning remains sound.

That does not justify stopping useful analysis indiscriminately. It justifies giving the uncertainty an owner. A smaller dataset, a more limited purpose or a different arrangement may be worth evaluating. Those are options for the responsible team to assess, not a promise that any one technique makes the information anonymous.

On Monday, ask the business sponsor and data owner to choose one proposed AI use that relies on an anonymity claim. Write down the intended benefit, the information needed and the parties involved. Include who acts for whom. Keep this description separate from the eventual conclusion so that an attractive business case does not become evidence of privacy protection.

By midweek, have the privacy lead examine the existing assessment and its assumptions. Identify missing evidence and commission only authorised, controlled testing where needed. Do not paste private customer records into a public AI service to see whether it can identify people. The review should not create the exposure it is meant to assess.

By Friday, record a decision: proceed within an evidenced scope, change the proposal or resolve named questions before approval. If the organisation has relevant practical evidence for the consultation, decide whether to submit it before the deadline. Participation is optional; a useful internal review does not require a public submission.

Organisations handling data within GDPR's scope need to assess the European legal context. Those in the UK, North America, Asia-Pacific, Africa, the Middle East and Latin America should not treat this draft as a worldwide permission or prohibition. Applicable privacy rules, contractual roles and cross-border arrangements need their own assessment.

The practical review also depends on local circumstances: accessible records, languages, institutional knowledge and specialist capacity can affect what is plausible and what can be tested. This scan supplies no comparative regional re-identification rates. Avoid replacing missing evidence with a blanket assumption that one market's assessment will travel unchanged.

End the week with a short answer the business can use: what is approved, on what evidence, within which limits, and who will revisit it when the circumstances change? An anonymity label should make that decision clearer, not stand in for it.