De-Identification: What It Is & Why It Matters

What it is

De-identification is the process of removing or altering information so that an individual is no longer reasonably identifiable from it. The aim is to allow information to be used for purposes such as analysis or reporting while reducing the privacy risk to the individuals it originally concerned.

De-identification sits on a spectrum. Simply removing an obvious identifier such as a name does not always make information truly de-identified, because individuals can sometimes still be identified by combining remaining details. Effective de-identification considers the whole context, not just one field.

It is also important to recognise that de-identification is not always permanent or absolute; in some circumstances information thought to be de-identified can be re-identified. This explainer stays general, and the suitability of any de-identification approach depends on the situation and current guidance.

Key requirements

Approaching de-identification responsibly generally involves:

• Considering whether removing identifiers genuinely prevents re-identification in context.
• Looking at the whole dataset, since combinations of details can identify people.
• Treating de-identification as a matter of degree and risk, not a guaranteed switch.
• Keeping de-identified and identifiable information appropriately separated where relevant.

Whether information is truly de-identified is a judgement that depends on the data and context, and approaches and expectations evolve. This explainer does not state fixed techniques or thresholds; current guidance such as the OAIC should be consulted.

Why it matters for debt recovery

A recovery provider may want to use information for purposes such as analysis or reporting without exposing identifiable details about individuals. De-identification can support that, but only if done carefully; weak de-identification can give false comfort while individuals remain identifiable.

For a prospective client, a provider's understanding of de-identification reveals how sophisticated its privacy thinking is. Recognising that de-identification is about managing re-identification risk, not just deleting names, is a sign of genuine maturity.

Our Trust Centre covers related topics including data minimisation and sensitive-information handling.

What to ask a provider

Useful questions include: When the provider de-identifies information, how does it judge whether individuals could still be re-identified? Does it consider the whole dataset rather than just removing names? And does it understand that de-identification is about managing risk rather than a guaranteed outcome?

Look for an answer that treats de-identification as a careful, context-aware process. A provider that equates removing a name with full de-identification has an oversimplified, riskier view.

How Merion approaches it

Merion follows the principle that de-identification is about meaningfully reducing the chance that individuals can be identified, not simply stripping an obvious field. Where we use de-identification, we aim to consider the whole context and the risk of re-identification, and to treat it as a matter of degree rather than a guaranteed switch.

This is general information only and not legal advice, and it asserts no certification. Whether information is genuinely de-identified depends on the data and context, so the OAIC and independent advice are the right sources for specifics.