A hospital wants to share a dataset with outside university researchers. The agreement requires that no individual can ever be re-identified, even by the hospital. Which data protection technique meets this requirement?
Select an answer to reveal the explanation.
Short Explanation
If even you must not be able to trace it back, then you can't keep a decoder ring in the drawer. Anonymization burns the bridge back to the person for good. Tokens and encryption are the trap, because the hospital still holds the way back to each patient.
Full Explanation
Anonymization transforms data so that individuals cannot be identified by any party, using techniques such as removing direct identifiers, generalizing quasi-identifiers like dates and postal codes, and aggregating, with no retained mapping back to the original records. Because the process is irreversible, it satisfies a requirement that not even the data owner can re-identify subjects. Pseudonymization replaces identifiers with tokens, but the hospital's lookup table links each token back to a patient, so re-identification remains possible by design. Data masking presented at query time hides values from the researchers' view while the underlying records stay identifiable, and the hospital can unmask them. Column-level encryption with a hospital-held key is reversible by the key holder, so the hospital can always decrypt the identities. Exam caveat: removing names alone is rarely sufficient; combinations of quasi-identifiers such as birth date, gender and postal code can re-identify people, so anonymization must address indirect identifiers as well. Operational check: before release, test the dataset for small groups of records sharing the same combination of quasi-identifiers, confirm no mapping table or key exists that links back to patients, and document the method used.