<figure><img src="image_1.png" /></figure>

HAL
open science

# Survey Data Anonymisation and Pseudonymisation

Julie Baron, Julie Lenoir, Arianna Caporali, Thomas Merly-Alpa

► To cite this version:

Julie Baron, Julie Lenoir, Arianna Caporali, Thomas Merly-Alpa. Survey Data Anonymisation and Pseudonymisation. 2022, pp.20. hal-05097462

HAL Id: hal-05097462

https://hal.science/hal-05097462v1

Submitted on 4 Jun 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
2021

SURVEY DATA
ANONYMISATION AND
PSEUDONYMISATION

CREATORS: JULIE BARON, JULIE LENOIR

APPROVED BY: ARIANNA CAPORALI, THOMAS MERLY-ALPA

DATE: SEPTEMBER 2021

DOCUMENT ID: MADD04

VERSION: 1.0

INED DATALAB - PROGEDO

QUETELET

PRO
GE
DO

DIFFUSION
# 1. Introduction

In the current context of Open Research Data, the French Institute for Demographic Studies (INED)<fnref n="1" /> encourages the sharing and reusing of its data, in accordance with the National Plan for Open Science<fnref n="2" />, and aims to make its data as easily accessible as possible. At the same time, scientific disciplines, particularly the humanities and social sciences, use materials (statistical surveys, interviews, archives, etc.) that often contain personal data, requiring special precautions. The General Data Protection Regulation (GDPR)<fnref n="3" />, which came into force in May 2018, requires data controllers (and processors) to define and implement measures to demonstrate their compliance with the Regulation at all times. Citizens now have greater control over how their data can be used and stricter measures on the dissemination of data are in place. Research institutes that make their data widely available are faced with the following dilemma: how to protect respondents, while making their data as open and accessible as possible? At INED, as in other research institutes, access to data is "as open as possible and as closed as necessary". To find the right balance between two seemingly contradictory injunctions, several tools can be used. As data anonymisation is an almost impossible ideal to achieve<fnref n="4" />, INED pseudonymises its data and the dissemination of files is subject to specific conditions of access to minimise the risks of re-identification. This document briefly describes the protective measures that are applied to INED surveys made available via the Quetelet PROGEDO Diffusion application<fnref n="5" />. It aims to contribute to the dissemination of good practices in the production and management of survey files at INED. It is intended for users of survey data files and, more generally, for anyone wishing to learn about the procedures for managing and disseminating INED survey data files.

# 2. About anonymisation

Within a database, the information posing a risk to respondents may be directly identifying data, such as first names or dates of birth, or indirectly identifying data, such as certain variables which, as such or in combination with others, make it possible to find the targeted individual. At present, anonymisation is the main solution for respecting data protection. According to the Commission Nationale de l'Informatique et des Libertés (CNIL)<fnref n="6" />, anonymisation is an irreversible operation that consists of applying a set of techniques that makes it impossible, in practice, to identify the person by any means whatsoever.

For a dataset to be truly anonymous, the European data protection authorities<fnref n="7" /> define three main criteria:

- Non-individualisation: it must not be possible to isolate an individual in the dataset

- Non-correlation: it must not be possible to link separate datasets concerning the same person

- Non-inclusion: it should not be possible to infer any new information about an individual with any degree of certainty.

To anonymise a database in accordance with these three criteria, techniques may include:

- Addition of noise: altering the accuracy of information by adding random noise

- Permutation: mixing attribute values within the dataset

- Randomisation: changing the attributes of a dataset so that they are less precise, while maintaining the overall distribution

<footnote n="1">¹ https://www.ined.fr/en/.</footnote>

<footnote n="2">² https://cache.media.enseignementsup-recherche.gouv.fr/file/Recherche/50/1/SO_A4_2018_EN_01_leger_982501.pdf.</footnote>

<footnote n="3">³ https://gdpr-info.eu/.</footnote>

<footnote n="4">⁴ See section 2 of this document.</footnote>

<footnote n="5">⁵ https://commande.progedo.fr/en/utilisateur/connexion.</footnote>

<footnote n="6">⁶ https://www.cnil.fr/en/home.</footnote>

<footnote n="7">⁷ https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp216_en.pdf.</footnote>
-Generalisation: changing the granularity of values to form groups.

The combination of these methods should avoid direct and indirect correlations and consequently comply
with European data protection laws, which govern all EU-based researchers collecting personal data.

In practice, however, full anonymisation is difficult to guarantee and strict compliance would result in data
that is difficult to use for analysis. As such, pseudonymisation is a compromise between keeping the
original data and disseminating a completely anonymised dataset. Pseudonymisation refers to the
processing of data so that "it is no longer possible to attribute the data to a natural person without recourse
to additional information<fnref n="8" />". Data resulting from pseudonymisation are considered to be "personal data and
therefore remain subject to the obligations of the GDPR. However, the EU Regulation encourages the use of
pseudonymisation in the processing of personal data. Furthermore, the GDPR considers that
pseudonymisation reduces the risks to data subjects and contributes to compliance with the Regulation<fnref n="9" />".

Anonymisation or pseudonymisation of a database is therefore generally done on a case-by-case basis,
according to the rules established by each institute in agreement with the data protection officer.

At INED, the databases disseminated are considered pseudonymised, but their dissemination is
accompanied by other protective measures such as informed consent and impact analyses in advance, and
specific conditions for access to the data subsequently.

3. About pseudonymisation at INED

Before producing a file that can be disseminated, a "source file" is produced for each survey. Created from the raw survey data by the research teams and research support services, this source file is then sent to the DataLab within INED's Surveys Department<fnref n="10" /> with a view to being disseminated, within 3 years after the end of data collection (a policy edicted by INED's Scientific Council)<fnref n="11" />. Only one person at the DataLab, the Documentation and Data Availability Officer, has access to this file, which he or she is responsible for processing and storing on a secure server<fnref n="12" />. The complexity and time required by the processing of the source file will depends on the themes that the survey deals with, the variables it contains and the number of people interviewed. However, there are common elements to all the procedures applied at INED:

-Removal of all direct identifiers (address, names, telephone numbers, SIREN<fnref n="13" /> number for companies, etc.)

-Treatment of geographical variables, particularly those relating to *communes (city)*. These can either be deleted or made less precise by aggregating to a higher geographical level (for example, the name of a *canton* will be abandoned in favour of the *arrondissement*). In accordance with the requirements of the CNIL, the lower limit for geographical areas is set at 2000 inhabitants. Generally, the departmental (NUTS3) or regional (NUTS1) level is preferred.

-Income brackets are aggregated, or the continuous income distribution is truncated at the top 5%.

-Occupation variables are limited to the 42-category list<fnref n="14" />.

Special attention is reserved for variables with plain text (variables from open-ended questions, intentionally not recoded into categories). If they are not of specific interest to the research, they are deleted or recoded.

<footnote n="8">⁸ https://www.cnil.fr/en/node/114427.</footnote>

<footnote n="9">⁹ Idem.</footnote>

<footnote n="10">¹⁰ See the document "INED DataLab" (MADD01).</footnote>

<footnote n="11">¹¹ See Appendix 2 of the document "Data and documentation acquisition procedure" (MADD02).</footnote>

<footnote n="12">¹² See Appendix 4 of the document " Data and documentation acquisition procedure" (MADD02).</footnote>

<footnote n="13">¹³ https://www.insee.fr/en/metadonnees/definition/c1135</footnote>

<footnote n="14">¹⁴ According to INSEE's official nomenclature of professions and socio-professional categories (https://www.insee.fr/fr/information/2400059).</footnote>
Subsequently, using an R program run on the database in SAS format<fnref n="15" />, all the variables for which at least one modality has between 1 and 5 occurrences are extracted from the database, collected in an Excel file<fnref n="16" /> and reviewed by the entire DataLab team at a dedicated meeting. They are systematically reviewed from the perspective of a situation in which a malicious individual might wish to re-identify someone without knowing their characteristics. This meeting provides an opportunity to assess the risk of potential harm to the respondents if their identity were to be revealed. It is then a question of determining which variables are potentially identifying as such or when crossed-referenced and of modifying the level of precision to an acceptable degree in relation to the double risk of identification and the associated harm.

At the end of the meeting, proposals for the recoding, aggregation or deletion of data are formulated directly by the DataLab on the Excel file containing the extracted problematic variables. The Excel file is then sent to the research teams for validation or refusal with counter-proposals. A second meeting is organised with both the DataLab and the research team in case any variables require further discussion.

Once the Excel document is finalised with the decisions taken and validated by both units, the processing of the source file in SAS can begin. A program is written and executed<fnref n="17" /> by the person in charge of data provision. The source file will become a "Scientific Use File" and will be analysed a second time by the DataLab Manager<fnref n="18" />. This double check minimised the risk of overlooking variables that should have been processed and that were not detected the first time. A PDF note listing all the decisions taken and recoding operations carried out, including the research team's validation and the date of this validation, is created and stored with the rest of the documentation and files<fnref n="19" />. The DataLab then becomes fully responsible for the two files under its remit: the raw file initially sent by the research team for archiving and the newly created Scientific Use File for distribution through Quetelet PROGEDO Diffusion plateform.

## 4. Conditions of access to data

Since pseudonymised data are not equivalent to anonymised data, the legal regulations in force require that access to Scientific Use Files be limited to the conditions set out in the user contract co-drafted<fnref n="20" /> by INED's partners (ADISP, CDSP<fnref n="21" />) under the TGIR PROGEDO<fnref n="22" />. Data providers have worked with the Statistical Confidentiality Committee<fnref n="23" />, the body that guarantees the application of statistical confidentiality rules in France, to set up a harmonised procedure for the dissemination of files.

Consequently, INED survey data are accessible, free of charge, to French and foreign researchers, doctoral students, post-doctoral fellows and students for research, scientific production and in some cases teaching purposes via the Quetelet PROGEDO Diffusion platform.

INED asks data users, via the Quetelet PROGEDO Diffusion platform, for their contact details, including a mandatory institutional e-mail address for the user (guaranteeing membership of a research or teaching organisation), the contact details of their institution, and a brief description of the intended use of the dataset or datasets. The DataLab checks the conformity of all the information provided by the user and verifies that the institution to which he or she belongs is listed in Annex 2 of the Statistical Confidentiality

<footnote n="15">¹⁵ See Appendix 1: Pseudonymisation procedure - Step 1 – R code to identify variables whose modalities contain frequencies between 1 and 5.</footnote>

<footnote n="16">¹⁶ See Appendix 2: Pseudonymisation procedure - Step 2 – Excel file used as a basis for decision making for the treatment of identifying variables (example).</footnote>

<footnote n="17">¹⁷ See Appendix 3: Pseudonymisation procedure - Step 3 – SAS code run by the DataLab to make the source file pseudonymised (example).</footnote>

<footnote n="18">¹⁸ See Appendix 4 and 5 of the document "INED DataLab" (MADD01).</footnote>

<footnote n="19">¹⁹ See Appendix 5: Pseudonymisation procedure - Step 4 – Modifications of data files for pseudonymisation purposes: record of decisions.</footnote>

<footnote n="20">²⁰ https://commande.progedo.fr/Proc%C3%A9dure_FPR-Nouveaux_utilisateurs.pdf.</footnote>

<footnote n="21">²¹ ADISP: National Archive of Data from Official Statistics (http://www.progedo-adisp.fr/index_en.php) CDSP: Centre for Socio-political data (https://cdsp.sciences-po.fr/en/).</footnote>

<footnote n="22">²² http://www.progedo.fr/en/.</footnote>

<footnote n="23">²³ https://www.comite-du-secret.fr/.</footnote>
Committee's revised opinion of 14 December 2018 on access to Scientific Use Files<fnref n="24" />. Once this information has been validated by the DataLab, two forms generated via the Quetelet PROGEDO Diffusion platform are sent to the user for reading and signature. Users must then return these forms, signed by hand, in PDF format, to the Quetelet PROGEDO Diffusion platform.

These forms require users to respect ethical and legislative standards regarding the re-use of data.

In particular, by signing the forms, users undertake to:

- Use the data provided for research purposes only, without intent or attempt to re-identify specific individuals or organisations

- Refrain from sharing the data with any third party

- Protect all data by physical and logical procedures to avoid damage

- Perform secondary analysis of data in accordance with accepted professional practices

- Acknowledge data sources in their publications in accordance with the citation model for data use

- Inform the data provider of relevant publications. If necessary, report data quality or problems encountered when using the data

- Inform the data provider if the same data is being used for another research project. The license contract also requires that the user undertakes to read, understand and respect the rules applicable to these data (Article 12 of Law 78-753 of 17 July 1978, modified by Order 2005-650 of 6 June 2005²⁵).

Of the two forms, one is intended for INED<fnref n="26" /> and will be archived on a secure server, the other<fnref n="27" /> is sent by e-mail to the Statistical Confidentiality Committee for access authorisation.

The French Archives Directorate<fnref n="28" />, after receiving the Statistical Confidentiality Committee's opinion and subject to INED's initial agreement, then authorises access to the data by filling in a secure shared table containing the individual application numbers. The data are then sent to the user via the Quetelet PROGEDO Diffusion platform.

The user of the research data is ultimately responsible for the rigorous use of the data for the purposes expressed at the time of registration, in compliance with the stipulated conditions of use. So far, there has been no need to sanction the misuse of INED data. In case of non-compliance, however, INED reserves the right to close the account of any user who violates the regulations, with PROGEDO's approval. In the future, INED and PROGEDO may develop a system of control and sanctions if data abuse occurs.

## Conclusion

Ultimately, the confidentiality of each survey respondent's data is a genuine scientific commitment that research institutes must honour. Each database therefore requires meticulous work, undertaken by several people. In all cases, caution is required. In order to limit the risks of re-identification of respondents, to respect the law and to preserve the analytical usefulness of its data, INED has developed, in partnership with the TGIR PROGEDO, a global procedure for the protection of surveyed individuals which combines informed consent, pseudonymisation and data access controls.

<footnote n="24">²⁴ https://www.comite-du-secret.fr/wp-content/uploads/2021/07/FPR-avis-initial-14-12-2018-modifie-14-06-2021.pdf.</footnote>

<footnote n="25">²⁵ https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000629684/.</footnote>

<footnote n="26">²⁶ See Appendix 6: Access conditions - Access form for Scientific Use File.</footnote>

<footnote n="27">²⁷ See Appendix 7: Access conditions - Confidentiality commitment submitted to the Statistical Confidentiality Committee.</footnote>

<footnote n="28">²⁸ https://francearchives.fr/#.</footnote>
## Refrences

Avis 05/2014 du groupe de travail « article 29 » du 10 avril 2014 sur les Techniques d'anonymisation.
*Commission Européenne*. 2014.

BENEDETTI, Roberto and FRANCONI, Luisa, 1998. Statistical and technological solutions for controlled data dissemination. In: *Pre-proceedings of New Techniques and Technologies for Statistics*. 1998. p. 225–232.

BERGEAT, Maxime, 2015. Anonymisation de données individuelles: bien calées, bien protégées? In: *Journées de Méthodologie Statistique* [online]. INSEE. 2015. Available from: [http://www.jms-insee.fr/2015/S09_2_ACTE_BERGEAT_JMS2015.PDF](http://www.jms-insee.fr/2015/S09_2_ACTE_BERGEAT_JMS2015.PDF)

Guide du secret statistique. INSEE. 2020. Available from: [https://www.insee.fr/fr/information/1300624](https://www.insee.fr/fr/information/1300624).

HUNDEPOOL, Anco, DOMINGO-FERRER, Josep, FRANCONI, Luisa, GIESSING, Sarah, LENZ, Rainer, LONGHURST, Jane, NORDHOLT, E. Schulte, SERI, Giovanni and WOLF, P., 2010. Handbook on statistical disclosure control. *ESSnet on Statistical Disclosure Control*. 2010.

INSHS, Isabelle André-Poyaud, ASTOR, Sandrine, BOUDJAABA, Fabrice, BUJAN, Gaëlle, COLLIGNON, Béatrice, DUBOIS, Frédéric, KESSOUS, Emmanuel, MAUREL, Lionel and ROGER, Muriel, 2019. Les sciences humaines et sociales et la protection des données à caractère personnel dans le contexte de la science ouverte: guide pour la recherche. Available from: [https://inshs.cnrs.fr/sites/institut_inshs/files/pdf/guide-rgpd_2.pdf](https://inshs.cnrs.fr/sites/institut_inshs/files/pdf/guide-rgpd_2.pdf).

NGUYEN, Benjamin, 2014. Techniques d'anonymisation. *Statistique et société*. 2014. Vol. 2, no. 4, p. 53–60.
*hal-01113412*. Available from: [https://hal.archives-ouvertes.fr/hal-01113412](https://hal.archives-ouvertes.fr/hal-01113412).

SILBERMAN, Roxane, 2011. La protection des données individuelles en France et la recherche en sciences sociales. *La France dans les comparaisons internationales. Guide d'accès aux grandes enquêtes statistiques en sciences sociales*, Paris, Presses de Science Po. 2011. P. 183–204.

STAM, Alexandra, KLEINER Brian, 2020. Data anonymization: legal, ethical, and strategic considerations.
*FORS Guide No. 11, Version 1.0. Lausanne: Swiss Centre of Expertise in the Social Sciences FORS*. 2020.
doi:10.24449/FG-2020-00011.
Summary and description of Appendices

Appendix 1 - PSEUDONYMISATION PROCEDURE - STEP 1 – R code to identify variables whose modalities contain frequencies between 1 and 5..................................................................................................................8

This document contains three R markdown scripts created by the DataLab computer scientist with the R software. They are used every time a dataset meant to be made available is received by the DataLab. From a SAS database, the scripts generate two html documents. The first one contains a list of variables for which there is at least one modality with a frequency between 1 and 5. The second one contains descriptive tables of the variables identified in the first document. The DataLab can then examine these variables and make recoding or deletion proposals to be discussed with the research team.

Appendix 2 - PSEUDONYMISATION PROCEDURE - STEP 2 – Excel file used as a basis for decision making for the treatment of identifying variables (example)..................................................................................................................13

This document presents an extract of the Excel file used in the data pseudonymisation procedure. This model is used systematically for all surveys. All the variables extracted using the R code (see Appendix 1) are sorted flat and placed in this Excel file. One column is reserved for the DataLab and allows the entry of recoding or deletion proposals for each variable. A second column is reserved for the research team to validate or reject the proposals. In case of rejection, the research team proposes a different recoding operation, which must be discussed with the DataLab. The final decision is written in the last column. This document provides a structure for the exchanges between the Documentation and Data Availability Officer, the rest of the DataLab team and the research team concerning the pseudonymisation of each INED survey.

Appendix 3 - PSEUDONYMISATION PROCEDURE - STEP 3 – SAS code run by the DataLab to make the source file disseminable (example) ..................................................................................................................14

This document presents a SAS code model used at the DataLab to pseudonymise a survey before it is made available. The recoding of variables is done "hard" in the database, using a "data/set" procedure to create new pseudonymised databases (Scientific Use File). An anonymous identifier is also created to replace the original in the source file, and the mapping tables are kept at the DataLab on a secure server, together with the source file(s). In general, similar SAS procedures are used for all surveys before they are made available.

Appendix 4 - PSEUDONYMISATION PROCEDURE – Identifying variables: typical cases and solutions..................17

This document serves as a reference by presenting practical cases of variables with risk of re-identification and possible solutions for recoding these variables or creating new identifiers. It illustrates the methodology used by the DataLab to pseudonymise source files.

Appendix 5 - PSEUDONYMISATION PROCEDURE - STEP 4 – Modifications of data files for pseudonymisation purposes: record of decisions ..................................................................................................................18

This document presents an extract of the PDF file created at the end of the pseudonymisation procedure for each survey. When the databases have been processed by the DataLab and a Scientific Use File has been created, a file is completed that tracks all the pseudonymisation-related operations performed on the database. Decisions and the dates of decisions are recorded. This file is then sent to the research team and archived on a secure server at the DataLab, along with the rest of the survey documentation.

Appendix 6 - ACCESS CONDITIONS – Access form for Scientific Use File................................................................19
# PSEUDONYMISATION PROCEDURE - STEP 1

R code to identify variables whose modalities contain frequencies between 1 and 5

* `variables_list.Rmd`: creates an HTML document containing the list of variables in a SAS database for which there is at least one modality with a frequency between 1 and 5.

* `variables_descriptions.Rmd`: creates an HTML document containing descriptive tables for the variables identified in the first document.

* The code that creates the tables in the final HTML document is embedded in `desc_process.Rmd`.

```r
PROGRAM NAME: VARIABLES_LIST.RMD
---
title: "Search for identifying variables"
output: html_document
---
```r
setup, include=FALSE
knitr::opts_chunk$set(echo = FALSE)
```r
setup2, echo=FALSE, warning=FALSE, message=FALSE
```r
# Packages
library(haven)
library(tidyverse)
library(magrittr)
library(knitr)
library(stringi)
library(kableExtra)
# Path
base ="
path ="
```r
header, echo=FALSE, eval=TRUE}
cat("Database :", base, "\n")
cat("Method : \n if a variable has one modality which frequency is between 1 and 5 \n the variable is considered potentially identifying. \n")
cat("Note : variables that are individual identifiers are not taken into account here.")
```r
table, echo=FALSE, warning=FALSE, message=FALSE
```r
# Database
bdd = data.frame(read_sas(paste0(path, base)))
# Descriptive table
pb_variables = tibble(
  variable = character(),
  label = character(),
  type=character(),
  pb_mods = numeric(),
  total_nb_mods = numeric())
```r
```r
```
```r
# Loop on variables : checking if variables are potentially identifying

for (i in 1:dim(bdd)[2]) {

  var_name = names(bdd)[i]
  label = attr(bdd[[var_name]], "label")

  desc = bdd %>%
    group_by(.data[[var_name]]) %>%
    tally(name='Frequency') %>%
    mutate(ano_test = (Frequency > 0 & Frequency <= 5))

  if (is null{label}) {label="missing label"}

  if (any desc$ano_test == TRUE) & all{stri_detect fixed{label, c("Identifier", "identifier")}==FALSE}) {
    pb_variables = add_row.pb_variables,
      variable = var_name, label = label,
      type = class(bdd[[var_name]]),
      pb_mods = sum desc$ano_test),
      total_nb_mods = dim desc)[1])
  }
}
```

```
#Table of variables found by the above algorithm

pb_variables %>%
  kable() %>%
  kable_styling()
```

```
```

```r
PROGRAM NAME: VARIABLES_DESCRIPTORS.RMD
---
title: "Variables description"
output: html_document
---
```{r setup, include=FALSE}
knitr::opts_chunk$set(echo = FALSE)
````
# Survey : ""
# Database : ""
```{r table, echo=FALSE, eval=TRUE, include=FALSE, message=FALSE, warning=FALSE}
# Packages
library(haven)
library(tidyverse)
library(knitr)
cat("\n #Fichier : ", base)
# Path to database
bdd = ""
path = ""
#
# Database import
bdd = data.frame(read_sas(paste0(path, bdd)))
```
```r
rmarkdown::paged_table(as.data.frame desc))

# Descriptive statistics for numerical variables

if (var_type == "character") {
  nouw = count_na(bdd[[var_name]])
  cat("\n\n Number of missing data :", nouw, "\n")
}

if (var_type == "numeric") {
  cat("\n\n##### Statistical informations \n")
  var_sum = bdd %>%
    dplyr::select(.data[[var_name]]) %>%
    dplyr::summarise_all(list(Total = ~n(), NoAnswer = count_na, Minimum = min, Maximum = max, Mean=mean, SdDev sd)) %>%
    dplyr::mutate(across(is.numeric, round, 3))

rmarkdown::paged_table(as.data.frame(var_sum))
}

```

```r
'r paste(out, collapse='\n')'
```
# PSEUDONYMISATION PROCEDURE - STEP 2

Excel file used as a basis for decision making for the treatment of identifying variables (example)

* These Excel files are used as a basis for discussions during meetings with the teams involved in the database anonymisation process. These tables are examples of what can be done to pseudonymise variables.

The variable with risk of re-identification is extracted into an Excel file.

A column is reserved for the treatment of the variable proposed by the DataLab to limit the risks of re-identification.

A column is reserved for the validation, or rejection (with, in this case, a new proposal) of the research team on this treatment.

A column specifies the final decision taken.

<table><thead><tr><th colspan="4">VARIABLE LABEL</th><th>NAME OF THE DATASET</th><th>VARIABLE TYPE</th><th>DataLab proposal</th><th>Proposal of the research team</th><th>Final decision</th></tr></thead><tbody><tr><td colspan="4">Label</td><td>Xdatabase</td><td>Text</td><td>Group modalities D and E into 1 modality "D-E".</td><td>AGREE</td><td rowspan="8">Group modalities D and E into 1 modality "D-E".</td></tr><tr><td rowspan="7">VAR1</td><td>Frequency</td><td>Percentage</td><td>Cumulative frequency</td><td></td><td></td><td></td><td></td></tr><tr><td>A</td><td>460</td><td>48.37</td><td>460</td><td></td><td></td><td></td></tr><tr><td>B</td><td>72</td><td>5.90</td><td>532</td><td></td><td></td><td></td></tr><tr><td>C</td><td>317</td><td>33.40</td><td>849</td><td></td><td></td><td></td></tr><tr><td>D</td><td>15</td><td>3.37</td><td>864</td><td></td><td></td><td>D-E</td></tr><tr><td>E</td><td>3</td><td>0.32</td><td>867</td><td></td><td></td><td></td></tr><tr><td>F</td><td>41</td><td>4.11</td><td>908</td><td></td><td></td><td></td></tr><tr><td>G</td><td>56</td><td>4.53</td><td>964</td><td></td><td></td><td></td><td></td></tr><tr><td colspan="8">Missing = 2194</td></tr></tbody></table>

* Once the final decision has been made and validated, recoding is carried out on the SAS software. In this example, there are no longer any modalities with frequencies less than or equal to 5, which limits the risk of re-identification.

<table><thead><tr><th colspan="4">BEFORE PSEUDONYMISATION</th><th colspan="4">AFTER PSEUDONYMISATION</th></tr><tr><th colspan="4">Label</th><th colspan="4">Label</th></tr><tr><th>VAR1</th><th>Frequency</th><th>Percentage</th><th>Cumulative frequency</th><th>VAR1</th><th>Frequency</th><th>Percentage</th><th>Cumulative frequency</th></tr></thead><tbody><tr><td>A</td><td>460</td><td>48.37</td><td>460</td><td>A</td><td>460</td><td>48.37</td><td>460</td></tr><tr><td>B</td><td>72</td><td>5.90</td><td>532</td><td>B</td><td>72</td><td>5.90</td><td>532</td></tr><tr><td>C</td><td>317</td><td>33.40</td><td>849</td><td>C</td><td>317</td><td>33.40</td><td>849</td></tr><tr><td>D</td><td>15</td><td>3.37</td><td>864</td><td>D-E</td><td>18</td><td>4.04</td><td>867</td></tr><tr><td>E</td><td>3</td><td>0.32</td><td>867</td><td>F</td><td>41</td><td>4.11</td><td>908</td></tr><tr><td>F</td><td>41</td><td>4.11</td><td>908</td><td>G</td><td>56</td><td>4.53</td><td>964</td></tr><tr><td>G</td><td>56</td><td>4.53</td><td>964</td><td colspan="4">Missing = 2194</td></tr></tbody></table>
## PEUDONYMISATION PROCEDURE - STEP 3

SAS code run by the DataLab to make the source file disseminable (example)

/* ---- STEP 1: First look at the dataset ---- */
/*********************************************************************/

/* Libname setup */
libname lib "D:\1234\**************";
run;

/* Database contents */
proc contents data=lib.database;
run;

/* Descriptive tables */
proc freq data=lib.database;
table _all_;
run;

/* ---- STEP 2: Look at the variables that need to be modified ---- */
/*********************************************************************/

/* ID = text, VAR1 = num, VAR3 = text, VAR4 = num, etc. */

/* proc freq on text variables or numerical variables with fewer modalities */

proc freq data=lib.database;
table VAR1 VAR3;
run;

/* proc print on numerical variables with a lot of modalities */

proc print data=lib.database (obs=20);
var ID VAR4;
run;

/* ---- STEP 3: Update variables ---- */
/*********************************************************************/

/* > STEP 3.1: Deletions */

/* List of variables to be deleted : VARX VARY VARZ */

data lib.database;
set lib.databaseBis;
drop VARX VARY VARZ;
run;

/* > STEP 3.2: Recoding modalities */

/* Case 1 : aggregate some modalities of numerical variables VAR8 & VAR75 */

data lib.database;
set lib.databaseBis;
/* proper variable initialisation */
length VAR8new $3.;
/* get values from original variable */
VAR8new = VAR8;
/* aggregate modalities over 70 */
if VAR8 >= 70 then VAR8new="70+";
/* delete original variable */
drop VAR8;
run;
```R
data lib.database;
set lib.databaseBis;
/* proper variable initialisation */
length VAR75new $12.;
/* get values from original variable */
VAR75new = VAR75;
/* aggregate modalities under 40 and over 100 */
if VAR75 <= 40 then VAR75new="40 or less";
if VAR75 >= 100 then VAR75new="100 or more";
/* delete original variable */
drop VAR75;
run;
```

```R
/* Case 2 : aggregate some modalities of text variable VAR13 */
```

```R
data lib.database;
set lib.databaseBis;
/* proper variable initialisation */
length VAR13new $356.;
/* get values from original variable */
VAR13new = VAR13;
/* aggregate modalities over 70 */
if VAR13 == "Modality x" then VAR13new = "Other options (e.g : x, y, z)";
if VAR13 == "Modality y" then VAR13new = "Other options (e.g : x, y, z)";
if VAR13 == "Modality z" then VAR13new = "Other options (e.g : x, y, z)";
/* delete original variable */
drop VAR13;
run;
```

```R
/* Case 3 : create a new IDENTIFIER */
```

```R
/* set seed in case the code needs to be rerun */
data _null_;
call streaminit(0);
seed = ceil( (2**31 - 1)*rand("uniform") );
put seed=;
run;
```

```R
/* create a correspondance Database*/
data lib.IDdatabase;
set lib.database;
/* keep only the ID and create a new random variable*/
keep ID alea;
/* populate the random variable */
alea=ranuni(0);
run;
```

```R
/* sort IDs according to the random variable */
proc sort data=lib.IDdatabase;
by alea;
run;
```

```R
/* generate new ID */
data lib.IDdatabase;
set lib.IDdatabase;
IDnew = CAT(_N_);
drop alea;
run;
```

```R
/* sort ID database on IDs in preparation for the next step */
proc sort data=lib.IDdatabase;
by ID;
run;
```
/* merge working database and ID database */

data lib.databaseBIS;

merge lib.databaseBIS lib.IDdatabase;

by ID;

drop ID;

run;

/* reorder the ID variables (at the beginning of the table) */

data lib.databaseBis;

retain ID IDnew;

set lib.databaseBis;

run;

/* ---- STEP 4: Cleaning the database ---- */

*/*******************************************************************/

data lib.databaseBis;

set lib.databaseBis;

/* drop recoded variables */

DROP ID VAR8 VAR75 VAR13;

/* rename new variables */

RENAME IDnew=ID VAR8new=VAR8 VAR75new=VAR75 VAR13new=VAR13;

/* labels for new variables */

LABEL

ID="Individual Indentifier"

VAR8="... ... (recoded)"

VAR75="... ... (recoded)"

VAR13="... ... (recoded)"

run;
# PSEUDONYMISATION PROCEDURE

## Identifying variables: typical cases and solutions

When assessing the risks of individual re-identification in a particular data table, the DataLab specifically considers variables (numerical or categorical) for which at least one modality as a frequency between 1 and 5. The research and DataLab teams need to evaluate how the variable could be used alone as well as in combination with others variables to re-identify respondents. Depending on the type and content of the variable, different decisions can be taken. Generally speaking, we mostly have two ways to deal with re-identifying variables: recoding and aggregation or deletion. We give several examples of cases that have been dealt with in the past below.

* Individual identifiers.

**Problem:** It can happen that individual identifiers are built as a combination of several identifiers. This can allow users to make links between individuals or households which the research team might not want them to make. For instance, an identifier composed as an address ID, a household ID and an individual ID would allow user to find out which households lived at the same address.

**Solution:** Create a new identifier at random and store a correspondence database.

* Body weight.

**Problem:** Some respondents have unusually high weights compared to the rest of the sample. Again, this might provide a way to identify these respondents, especially in combination with other variables.

**Solution:** Aggregate the continuous variable. The new variable is categorical with intervals expressed in kilograms.

* Age or birth dates.

**Problem:** Especially in the case of surveys interviewing households, where there is information on various members of the household, age and birth dates are tricky to deal with. Having all the dates of births for an entire household can easily lead to re-identification.

**Solutions:**

* If details on days and months of birth are not particularly of use, delete them from the dataset.

* Aggregate age into range of five-years.

* The age variable can be modified to be a mix between a continuous and a categorical variable: outliers are aggregated into a couple of single categories while others are kept as they are.

* Dating website

**Problem:** The variable indicates the dating website via which the respondent met their current partner. Some websites were only mentioned by one or two respondents. In combination with other personnel information on the respondents, they could be identified.

**Solution:** Aggregate the websites that were mentioned by only one or two people into a "Other dating websites" category.
# PSEUDONYMISATION PROCEDURE - STEP 4

Modifications of data files for pseudonymisation purposes: record of decisions

At the end of the process, when the database has been modified and the Scientific Use File created, a summary document is created with the date of the decisions taken and the elements justifying these decisions. The SAS program used to carry out the recoding is attached to the document. The document is then shared with the research team and stored in the survey file archived on a secure server.

ined | DataLab

1

## PSEUDONYMISATION PROCEDURE - Variables at risk of re-identification, *name of the survey*

**Contextual information:**

Enter here any information that may help to understand decision making.

**In the database1:**

(X respondents, X variables)

**RECODINGS:**

* **VARIABLE NAME** (Variable label). Description of the identifying risks linked to this variable.
  Chosen recoding: Group modalities A,B,C,... with modality F "Modality Label".
  Validated by research team on dd/mm/yyyy

* **VARIABLE NAME** (Variable label). When grouped with other modalities, this variable becomes quite identifying for the extremes.
  Chosen recoding: Make multiples of 5.
  Validated by research team on dd/mm/yyyy

...

...

...

...

**DELETIONS:**

* **VARIABLE NAME** (Variable label). Description of the identifying risks linked to this variable.
  Validated by research team on dd/mm/yyyy

...

...

...

...
# ACCESS CONDITIONS

Access form for Scientific Use File (FR)

<figure><img src="image_3.png" /></figure>

<figure><img src="image_4.png" /></figure>

INED - Service des enquêtes

Mise à disposition des données
9 cours des Humanités
CS 50004 93322 Aubervilliers
Cedex

## Demande d'accès à des fichiers de production et recherche (FPR) n°****

Ce formulaire est à compléter et à retourner via l'espace de dialogue de votre demande n°****

### IDENTIFICATION

Nom Prénom :

Adresse e-mail :

Statut :

Nom de l'institution :

Adresse de l'institution :

### ENQUETE(S) DEMANDEE(S) / RENSEIGNEMENTS SUR LE PROJET DE RECHERCHE

### ENGAGEMENT

Je soussigné(e), M./Mme X, m'engage à respecter les conditions d'utilisation des fichiers INED diffusés par
Quetelet PROGEDO Diffusion :

- utiliser les données exclusivement dans une finalité de recherche ;

- ne pas céder ces données, sous quelque forme que ce soit, à une tierce personne, que ce soit à titre gratuit ou onéreux ;

- traiter ces données conformément aux règles de l'art et du secret statistique ;

- mentionner la source des données dans mes communications, publications... conformément au modèle de citation pour l'utilisation des données (cf. ci-après) ;

- informer le diffuseur de mes communications, publications... et lui en faire parvenir les références ;

- informer le diffuseur des constats relatifs à la qualité des données ou à leur difficulté d'utilisation ;

- informer le diffuseur de toute réutilisation des données pour une autre recherche que celle spécifiée ci-dessus ;

- détruire les fichiers à l'issue du travail de recherche ;

- respecter la règlementation en matière de protection des données personnelles.

Je déclare avoir pris connaissance de ce que toute infraction aux engagements mentionnés ci-dessus m'expose à des poursuites d'ordre pénal et / ou à des poursuites en responsabilité civile, avec toutes les conséquences pécuniaires que cela comporte au titre des dommages causés.

Cet engagement est individuel.

Date __________

Signature :
# ACCESS CONDITIONS

Confidentiality commitment submitted to the Statistical Confidentiality Committee (FR)

<figure><img src="image_5.png" /></figure>

Comité du Secret Statistique

## Engagement de confidentialité

### En application des dispositions suivantes :

* le règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l'égard du traitement des données à caractère personnel et à la libre circulation de ces données

* le livre des procédures fiscales, notamment ses articles L135 D et R135 D-1

* le code du patrimoine, notamment ses articles L213-2 et L213-3

* le code des relations entre le public et l'administration, notamment ses articles L311-8 (dans sa rédaction issue de l'article 36 de la loi n° 201-1321 pour une République numérique), R311-8-1 et R311-8-2

* la loi n° 51-711 du 7 juin 1951 modifiée sur l'obligation, la coordination et le secret en matière de statistiques notamment ses articles 6, 6bis, 7bis et 7ter

* la loi 78-17 du 8 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés

* la loi n° 2016-1321 du 7 octobre 2016 pour une République numérique et à l'occasion de l'autorisation d'accès à des données confidentielles

### Je soussigné(e), m'engage :

1. à ne transmettre en aucun cas les informations qui seront mises à ma disposition, ni à en faire état dans mes relations avec des tiers quels qu'ils soient

2. à m'assurer que les études et publications effectuées à partir des informations qui seront mises à ma disposition respecteront :

* les règles générales du secret statistique

* les règles de secret éventuellement spécifiques à certaines sources (disponibles dans leur documentation ou auprès des producteurs)

* de manière générale, toute procédure nécessaire dans le but d'empêcher l'identification directe ou indirecte d'unités statistiques individuelles

3. à communiquer les résultats des travaux fondés sur ces informations et les publications qui en seront faites au Comité du secret statistique, ainsi qu'au bureau des études statistiques en matière fiscale de la Direction générale des Finances publiques (pour les travaux sur les données d'origine fiscale) et à mentionner dans les publications les sources utilisées

4. à détruire :

* les fichiers de production recherche à l'issue du travail de recherche concerné

* les sources de données transmises par fichiers (hors celles mises à disposition via le CASD) avant ma date de fin d'habilitation et à en informer le comité du secret statistique

### Je déclare avoir pris connaissance de ce que toute infraction aux engagements mentionnés ci-dessus m'expose :

#### à des poursuites d'ordre pénal :

* articles 226-13 et 226-14 du code pénal (atteinte au secret professionnel)

« La révélation d'une information à caractère secret par une personne qui en est dépositaire soit par état ou par profession, soit en raison d'une fonction ou d'une mission temporaire, est punie d'un an d'emprisonnement et de 15 000 euros d'amende »

* articles 226-16 à 226-24 du code pénal (atteintes aux droits de la personne résultant des fichiers ou des traitements informatiques) dans le cas des informations relatives à des personnes physiques

#### à des poursuites en responsabilité civile, avec toutes les conséquences pécuniaires que cela comporte au titre des dommages causés.

Date

Signature :