Re-identification risk: definition, examples and measurement

What is re-identification risk?

Re-identifying means linking data that no longer carried a person's name back to that specific person. The risk exists as soon as the copy still contains elements that, alone or combined with other information, point to someone.

There are two kinds of elements:

• Direct identifiers point to a person on their own: name, email, phone number, IBAN, social security number. These are the first to go.
• Indirect identifiers, or quasi-identifiers, identify no one on their own but do in combination: a date of birth, a town, an occupation, an amount, the date of an event.

The GDPR sets the rule in Recital 26: to decide whether a person is identifiable, account should be taken of all the means “reasonably likely to be used” by the controller or by another person. What a third party already knows counts as much as what the copy contains. That is also what separates anonymization, which is irreversible, from pseudonymization, where the mapping table leads back to the people: see anonymization vs. pseudonymization under the GDPR.

What are the three WP29 criteria?

In its Opinion 05/2014 on anonymisation techniques, adopted on April 10, 2014, the Article 29 Working Party (WP29, since replaced by the EDPB) assesses every technique against three risks. The CNIL uses them on its page on anonymizing personal data (in French):

The WP29 draws a warning from this that applies to anything sent to an AI tool: pseudonymized data “cannot be equated to anonymised information as they continue to allow an individual data subject to be singled out and linkable across different data sets”.

These criteria have just been updated. On July 7, 2026, the EDPB adopted, for public consultation, Guidelines 02/2026 on anonymisation, which update the 2014 opinion and restate the three tests as No Record Isolation, No Linkage and No Inference. The EDPB also makes clear that anonymity should be assessed from each relevant entity's perspective, typically any party for whom the data is meant to be anonymous.

Which famous re-identification cases?

Four cases come up throughout the literature. Each illustrates a different mechanism.

Three lessons for a firm:

• Content identifies. AOL released no “personal data” in the everyday sense: the searches themselves pointed to Thelma Arnold, 62, who told the paper, “Those are my searches.” A client file tells a story, and the story identifies.
• A few elements are enough. Three fields for Sweeney, eight ratings for Netflix. What matters is not how many elements remain in the copy, but how rare they are in combination.
• A pseudonym must never be computable. For the taxis, hashing every possible number was enough. Pandurangan himself recommended assigning a totally random number to each identifier: that is the principle of a well-built mapping table.

Which indirect identifiers are in a legal file?

Once names, addresses and contact details are replaced with labels, here is what can still point to the matter. The AI guide of the Conseil national des barreaux (CNB, April 2026) calls for vigilance about identification through cross-referencing, even after pseudonymization, and itself cites “amounts, project names given internally, the way a contract is drafted” (our translation).

A fictitious example shows the combination effect. After pseudonymization, a sentence reads: “[PERSONNE_1], CFO of [ORGANISATION_1], dismissed on March 3, 2025, is claiming €412,318.27 before the Brive labor court, docket 25/00142.” Not a single name left, and yet the docket number alone points to the case, while the job title, date and town are enough for anyone who knows the local job market. For a legal analysis, “[PERSONNE_1], a senior executive dismissed in early 2025, is claiming about €400,000 before a labor court” gives the AI everything it needs.

How do you measure re-identification risk?

k-anonymity, for tables. Defined by Latanya Sweeney in 2002, it requires that each person in a dataset cannot be distinguished from at least k - 1 others on their quasi-identifiers. You measure k as the size of the smallest group sharing the same combination: k = 1 means at least one person is unique. The WP29 points out two limits: k-anonymity does not prevent inference (if everyone in the group has the same diagnosis, knowing the group is enough), and the classic mistake is inflating k by leaving some quasi-identifiers out. l-diversity, which requires several different sensitive values in each group, partly addresses the first flaw.

Simulated attacks, for text. A case file is not a table: indirect identifiers are scattered across sentences. The RAT-Bench benchmark, published in February 2026 by a team at Imperial College London, measures this risk directly. It generates synthetic texts containing direct and indirect identifiers, runs them through twelve anonymization tools, then asks a language model “attacker” to recover what it can. A person counts as re-identified if the attacker recovers a direct identifier, or if the recovered indirect attributes place them among fewer than five people in the US population (the k = 5 threshold common for data releases).

Three findings to keep in mind:

• Without anonymization, the average re-identification rate is 99%; with the best tool tested, it is still 30%.
• Risk rises from 44% when identifiers are written in their standard form to 69% when they are written in non-standard ways.
• Attributes conveyed only implicitly remain hard: most tools fail to reduce that risk.

These figures come from synthetic American texts, not French case files. They still confirm what every practitioner sees: automatic detection removes most direct identifiers, not the whole story. Our own detection benchmark, on a fictitious corpus, is published in detection benchmark and offline test, and the comparison with Presidio in Presidio: a measured detection comparison.

The insider test, for a firm. Short of a calculation, ask one simple question: would someone who knows the matter (opposing counsel, an employee of the client, a local reporter) recognize it in the copy? If so, an indirect identifier still needs handling.

How do you reduce the risk before using AI?

1. Minimize. Send only the documents and passages the task needs. The CNB recommends limiting context to what is strictly necessary, and Article 5 of the GDPR requires it through the data minimization principle.
2. Replace direct identifiers with stable labels. [PERSONNE_1], [ORGANISATION_2]: the same person keeps the same label in every document, so the AI can follow the reasoning without knowing the names.
3. Delete what the AI does not need. Docket numbers, contract references, lot numbers, project names.
4. Generalize what must stay. This is the technique the WP29 pairs with k-anonymity: a date to the month or year, an amount to a range, a town to a region, a job title to a category.
5. Review next to the original. Look for the indirect identifiers in the table above, then run the insider test.
6. Keep the table on your side. Not in the conversation, not with the copy: see the rules for the mapping table.

What side-by-side review adds, and its limits

AnonymFiles is built around this step. What it does:

• It handles direct identifiers on the computer. Names, organizations, addresses, contact details and private dates are detected by two models installed on the computer; emails, phone numbers and IBANs by rules. Nothing goes over the network.
• It keeps one label per person across the whole folder, and labels can be renamed.
• It shows each document next to its copy. You see what was masked and what remains, and you mask by hand a docket number, an amount or a rare job title.
• It exports nothing without approval, document by document. An approved document must be approved again if the original, the rules or the copy change.

Its limits, honestly:

• No statistical risk score. The app computes neither k-anonymity nor a re-identification probability: a forty-document case file is not a database, and no tool knows what opposing counsel or the local press already know.
• Indirect identifiers remain your call. Amounts are masked by hand; a rare job title, a court or a hearing date is not a name, and you decide whether it points to the matter.
• Detection is not perfect. None is: that is why review is mandatory before export, not optional.

To go further: how AnonymFiles works, pseudonymization software for lawyers and our use cases.