De-identification explained: what happens to the personal details in your records

What personal details your records may hold

The UK's Information Commissioner's Office (ICO) says that information about individuals acting as sole traders, employees, partners and company directors "where they are individually identifiable and the information relates to them as an individual may constitute personal data."

"Suppliers employ data scientists to scrub personally identifiable information and exclude HR records," MIT Technology Review reported. What "scrub" means can vary, so the words below matter.

Three words that don't mean the same thing

These definitions come from the UK's data protection regulator, the ICO. US rules are covered in the California and hashing sections further down.

Pseudonymization. The ICO describes this as "a technique that replaces information that directly identifies people, or de-couples that information from the resulting dataset." For example, a name might be swapped for a code.

Anonymization. The ICO calls this "the process of turning personal data into anonymous information so that a person is no longer identifiable."

De-identification. The term is widely used, but the ICO does "not encourage it as a synonym for anonymous information or pseudonymous data." It uses the term only in connection with section 171 of the UK's Data Protection Act 2018, which makes re-identifying "de-identified personal data" a criminal offense. In that context, "'de-identified' personal data is pseudonymised data or data that was considered anonymised but can be re-identified considering all means that are reasonably likely to be used."

So when a firm says your records will be "de-identified", ask which of these it means.

Why UK law treats pseudonymized data as personal data

The ICO says that "Data protection law does not apply to anonymous information." But "Pseudonymous information is still personal data and the law applies to it."

The ICO adds that turning personal data into anonymous information "counts as processing personal data", so the process itself needs a lawful basis, a clearly defined purpose and information for the people concerned. And if you receive data another organization claims is anonymous "but you are able to re-identify people from the dataset, you must then treat the data as personal data." The ICO notes that this guidance is under review following the Data (Use and Access) Act.

The ICO's "motivated intruder" test

The ICO says "Identifiability is about whether you can distinguish one person from other people with a degree of certainty", and that it "exists on a spectrum."

One check is the "motivated intruder" test. A motivated intruder is "someone who wishes to identify a person from the anonymous information that is derived from their personal information". The ICO says to assume this person is reasonably competent, can use resources such as the internet, libraries and public documents, and uses investigative techniques such as asking people who may know more. The intruder can be an outsider or "someone who is permitted access to it."

The ICO also asks "whose hands" the data will be in. "With public release, you should have a very robust approach to anonymisation." Where access is controlled, contracts and technical controls "play a role in the overall assessment."

California's three-part test for "deidentified" data

California's privacy law, the CCPA, applies to employee and business-contact data held by the businesses it covers; its amendments that took effect on January 1, 2023 ended the earlier exemptions. Under that law, "deidentified" means information that "cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer", provided the business that holds it:

1. "Takes reasonable measures to ensure that the information cannot be associated with a consumer or household."
2. "Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information" (with a narrow exception for testing its own process).
3. "Contractually obligates any recipients of the information to comply with all provisions of this subdivision."

A law firm's October 2026 article notes that, under this law, a transfer of workplace data for money is a sale of personal information unless the data meets this definition.

Hashing doesn't make data anonymous

Hashing uses math to turn a value, such as an email address or phone number, into a code that looks random but is the same every time. Staff in the US Federal Trade Commission's Office of Technology wrote in July 2024 that hashes "can still be used to identify users", and that "data is only anonymous when it can never be associated back to a person."

Why links between records matter, and what they risk

Linked records are part of what buyers say they value, as our guide to selling or licensing logistics company data to AI developers explains. The same law firm's article sets out the trade-off: "Buyers also want records to stay linked to each other, which is what makes the data valuable and what makes it possible to draw conclusions about individuals or small groups."

In the Spirit Airlines sale, the de-identification certification must hold "while preserving referential integrity across the data set", so the records stay linked to one another, Implicator.ai reported. The flight attendants' union objected. Because "the sale agreement requires links across datasets to be preserved," it was concerned that "information about individuals or small groups could potentially be reconstructed," Reuters reported.

Removing names deals with linkability, not confidentiality

The law firm's article puts it plainly: "De-identification also addresses whether a record can be linked to an individual, not whether its content is confidential." It also warns that "Email and chat contain other companies' confidential information, often covered by NDAs and commercial agreements."

Some federal rules protect shipment and client details, whether or not people's names are removed:

• Carriers and brokers covered by 49 U.S.C. 14908 may not disclose information about "the nature, kind, quantity, destination, consignee, or routing" of property without the shipper's or consignee's consent, where it may be used to their detriment or improperly reveal their business to a competitor. See freight brokers and agents and trucking and haulage.
• A parallel rule covers common carriers, marine terminal operators and ocean freight forwarders (46 U.S.C. 41103). See freight forwarders and NVOCCs.
• Customs brokers' client records are confidential. Beyond the client, its surety on a particular entry, DHS and other accredited US officers or agents, and a subpoena or court order, they may be disclosed only "when authorized in writing by the client" (19 CFR 111.24). The rule does not cover information that is available from a public source. See customs brokers.

The article's advice: "Exclude high-risk data entirely rather than relying on de-identification."

The safeguards proposed in the Spirit Airlines sale

In August 2026, Google won a bankruptcy auction for Spirit Airlines' internal business records. As reported, the proposed safeguards include:

• A separate de-identification firm. Spirit hired a firm to de-identify unstructured data, including corporate email, The Next Web reported. The consumer privacy ombudsman in the case raised a concern about another bidder that "proposed to perform the deidentification itself rather than use an independent agent", according to a Stretto case update.
• Certification before each transfer. "The agent must file a certification with the court before every transfer", The Next Web reported. The ombudsman asked that it also state how many passengers' details it found and removed.
• A public commitment. "The buyer must publicly commit not to try to reidentify the data", The Next Web reported. The buyer also "may not pass it on unless the recipient makes the same commitment."

The ombudsman recommended approval but did not assess whether the sale posed risks to Spirit's employees or third parties. Unions objected, and some vendors asked the court to enforce confidentiality agreements. Lawmakers warned that "conventional de-identification safeguards may not be sufficient to protect employee privacy", TravelPulse reported.

As of October 17, 2026, the court had not approved the sale. The hearing had been adjourned five times, most recently to November 6, 2026.

What can't be undone

As the law firm's article puts it: "Once data is used to train a model, it cannot practically be pulled back out." Forbes pointed to a 2020 study showing that large language models "can unintentionally memorize sequences from their training data verbatim, which can then be extracted with the right prompts."

So a gap in de-identification may not be fixable later. Check the method, and a sample, before anything leaves your hands.

Questions to ask a licensing firm about de-identification

The article's practical steps suggest that sellers "Select (or jointly select) the de-identification provider, approve the protocol, and require certification to the company's satisfaction."

1. Who does the de-identification, and can I approve that firm and its method?
2. Which details are removed or replaced, and how? Are names hashed or swapped for codes?
3. Will links between records be kept? If so, how is the risk of picking out people or small groups handled?
4. Can I review a sample of the output before I sign?
5. Is each delivery certified, and can I see the certification?
6. Does the buyer commit, publicly and in the contract, not to re-identify anyone, and must later recipients do the same?
7. What is left out entirely, such as HR records or other companies' confidential information?
8. What happens to the data when the license ends, or once it has trained a model?

How Insightlanes.com helps

We introduce owners of logistics businesses to a data licensing firm. Fill in our short form with your team size and years in business. Rough numbers are fine. If it looks like a fit, we introduce you to a firm that represents owners in these deals and email you its name. The firm explains its process and terms, usually over a few video calls, and you decide whether to go ahead.

• No cost. If you sign, the firm we introduce you to pays us a referral fee. You never pay Insightlanes.com anything.
• No calls from us. Everything from us is in writing, so you can decide in your own time. If you go ahead, the firm we introduce you to usually explains its process over a few video calls.
• You decide. Nothing is shared without your OK.

Read what you would be agreeing to, and get your own advice before you sign. This guide is general information, not legal advice.