Taking personal data out before a sale
AI buyers want what your data shows about the work, not about people. Here is what taking personal data out really means.
Picture made for ABURA Bureau.
Under Europe's data protection law, the rules do not apply to information that is truly anonymous. But data where people have been swapped for codes, and could be linked back with extra information such as a key, still counts as personal data.
Anonymous means that nobody has a means reasonably likely to be used to identify a person, on its own or combined with other information, taking account of the cost, the time and the technology available. It is a higher bar than removing names.
In practice, names, email addresses, phone numbers and ID numbers are the easy part. Personal details hide in free text, such as support tickets and chat messages, in images and recordings, and in rare combinations: a job title in a small town can point to one person.
Some data has its own test. In the US, health data counts as de-identified either when a fixed list of identifiers has been removed, or when an expert has documented that the risk of identifying anyone is very small.
Done well, it works at scale. During the pandemic, Google published aggregated, anonymised movement trends to help public health decisions, with no personal information made available.
On ABURA, a buyer first sees a small anonymised preview, made on the owner's own computer. ABURA holds only that small anonymised preview; the licensed copy goes straight from the owner to the buyer, with personal data taken out first.
If taking personal data out is more than your team can do, say so when you list. Help is part of the process.
