When is anonymous not anonymous?

We seem to have a bit of a stand-off with the Information Commissioner at the moment about what constitutes anonymised data. No, don’t run away – this is really important and rather interesting, I promise.

The Youth Justice Board has built a new system, unimaginatively called the YJMIS, to collect what purports to be anonymised statistical data every quarter from each local authority Youth Offending Team in England and Wales. This is data about offences, disposals, personal profile scores and interventions.

Anonymised? Well, it isn’t taking the child’s name or full address. It takes date of birth, ethnicity and the sector postcode – that is, the first half of the postcode plus the first digit of the second half.

Sector postcodes correspond pretty closely to electoral wards, and if you go to the ONS Neighbourhood Statistics site enter your postcode and then click ‘Ward’, you can get information about the area where you live.

Click ‘2001 Census: Census Area Statistics’ and then ‘Ethnic Group (UV09)’. If you live in an urban area, the chances are that there are hundreds of people from a variety of ethnic groups. So far, so good. Now try looking at, say, Frome in Somerset, or Tonypandy in South Wales, or Saffron Walden in Essex, or Dymock and Kempley in Gloucestershire – or, indeed, at Hough ward, which contains the Information Commissioner’s office.

Do you see the problem? Sector postcodes + ethnicity data do not provide anonymity for those in BME groups who live outside densely populated and ethnically diverse areas. Add in date of birth as well, and the chances are that you could narrow information down to one or two children.

This is not anonymised data but Youth Offending Teams have, with the blessing of the Information Commissioner, uploaded the first batch without seeking consent or giving anyone an opportunity to object on the grounds that they could be identified from the data. The local authority supplying the data remains the data controller.

Does this matter? Well, yes. On principle alone, it’s discrimination. Why should certain groups of people enjoy less protection than others? If you look at the YJMIS FAQs, they say that

“information to be shared is for the stated purposes of the prevention or detection of crime. Therefore, only organisations with this intent will be authorised.”

That means every local authority in the country + the police, and presumably any voluntary sector organisation or researcher who can demonstrate that they need access to YJMIS.

Given that the YJB has just had its second burglary in 18 months and, on the last occasion, server discs were stolen, access may not even be restricted to those who are appropriately ‘authorised’.