Abstract
A dataset can be called "anonymous" only if its content cannot be related to a person, not by any means and not even ex post or by combination with other information. Free text entries highly impede "factual anonymization" for secondary research. Using two source datasets from GPs' electronic medical records (EMR), we aimed at de-identification in an iterative and systematic search for potentially identifying field content (PIF).EMR data of 14,285 to 100 GP patients with 40 variables (parameters, fields) in 5,918,321 resp. 363,084 data lines were analyzed at four levels: field labels, their combination, field content, dataset as a whole. Field labels were arranged into eleven semantic groups according to field type, their frequencies examined and their combination evaluated by GP experts rating the re-identification risk. Iteratively we searched for free text PIFs and masked them for the subsequent steps. The ratio of PIF data lines' number over total number yielded final probability estimators. In addition, we processed a whole dataset using ARX open source software for anonymizing sensitive personal data. Results were evaluated in a data protection impact assessment according to article 35 GDPR, with respect to the severity of privacy breach and to its estimated probability.We found a high risk of re-identification with free text entries into "history", "current diagnosis", "medication" and "findings" even after repeated algorithmic text-mining and natural language processing. Scrupulous pre-selection of variables, data parsimony, privacy by design in data processing and measures described here may reduce the risk considerably, but will not result in a "factually anonymized" research dataset.To identify and assess re-identifying field content is mandatory for privacy protection but anonymization can be reached only partly by reasonable efforts. Semantic structuring of data is pre-conditional but does not help with erroneous entries.