The Gold Standard · Anthropology
Make the decision path visible
Redaction looks simple until the removed detail carries the meaning of the record. Hiding a name may be enough in one appeal; in another, the relationship between the named person, the mandate and the time of an access change is the contested fact. A black box can prevent disclosure, but it can also prevent correction.
The gold standard defines the disclosure purpose, models direct and indirect identification risk, preserves the context needed to test the decision and uses controlled access when a safe public-looking extract cannot carry the evidence fairly.
Choose the route closest to your decision
Chapter contents
Chapters 1–3
Chapters 4–6
Chapters 7–9
Chapters 10–12
CHAPTER 1 OF 12 · DEFINE THE PURPOSE
1. Start with the disclosure purpose
State who will receive the material, what claim they must be able to test and what use is permitted. The same source may need a different release for an appellant, an independent reviewer and a public report.
Redaction is not a generic cleaning step. It is a purpose-specific transformation whose success includes both privacy and evidential usefulness.
CHAPTER 2 OF 12 · DEFINE THE PURPOSE
2. Map direct and indirect identifiers
Direct identifiers include names, account numbers and contact details. Quasi-identifiers such as rare relationship, date, location or event sequence may identify someone when combined.
Do not assume that removing names makes a small community record anonymous. Consider what the recipient already knows and what linked sources are available.
Practical check
Write the decision, evidence and limit in three separate sentences. If one sentence depends on an unstated assumption, name it before continuing.
CHAPTER 3 OF 12 · DEFINE THE PURPOSE
3. Name the context that cannot be lost
List the dates, roles, authority chain, source type, sequence and limitations needed to understand the evidence.
A redaction plan should protect these relationships even if literal values are generalised or moved into a verified summary.
| Element | Question |
|---|---|
| Audience | Who receives it? |
| Claim | What must they test? |
| Context | Which relationships must survive? |
| Risk | Who could be identified? |
CHAPTER 4 OF 12 · REDACT WITH MEANING
4. Choose a disclosure model before choosing a masking tool
Options include a scoped summary, redacted extract, pseudonymised table, query interface, protected enclave or sealed independent review.
The least revealing model that still answers the appeal question is usually better than publishing a heavily damaged copy of the full file.
CHAPTER 5 OF 12 · REDACT WITH MEANING
5. Use consistent replacements and visible omissions
Replace the same person or role consistently, show where material was removed and preserve pagination or event order.
Inconsistent labels can make one actor look like several. Invisible deletion can make the remaining sentence appear to say something the source never said.
Practical check
Write the decision, evidence and limit in three separate sentences. If one sentence depends on an unstated assumption, name it before continuing.
CHAPTER 6 OF 12 · REDACT WITH MEANING
6. Worked example: redaction erases the authority chain
Suppose an audit extract says that Person A requested a proxy change and Person B approved it under a mandate signed by Person C. A first redaction removes all three names and relationship labels, leaving only “a request was approved”. The appellant cannot test whether the requester or approver had authority.
A revised release uses stable role labels, dates and mandate version while withholding identifiers: “existing proxy requested; records officer approved using mandate version 2; mandate holder was not contacted”. The appellant can now challenge the missing confirmation. Changed-context check: in a very small household, even role labels may identify everyone, so an independent reviewer may need the original while the appellant receives a narrower factual summary.
| Model | Use |
|---|---|
| Scoped summary | One factual hinge |
| Redacted extract | Source wording matters |
| Protected access | Context cannot be released safely |
| Sealed review | Independent inspection only |
CHAPTER 7 OF 12 · TEST THE RELEASE
7. Test re-identification risk against realistic attackers
Consider motivated insiders, relatives, community members and data brokers, not only a stranger with no background knowledge. Examine uniqueness, linkage routes and the consequences of a successful guess.
Risk is contextual and should be revisited when new datasets, public events or small-cell combinations change what can be inferred.
CHAPTER 8 OF 12 · TEST THE RELEASE
8. Test evidential usability with a second reviewer
Ask someone who did not prepare the redaction to reconstruct the event sequence, distinguish actors and identify the decision hinge.
If the reviewer reaches a different meaning from the original, the release has failed even when privacy risk is low.
Practical check
Write the decision, evidence and limit in three separate sentences. If one sentence depends on an unstated assumption, name it before continuing.
CHAPTER 9 OF 12 · TEST THE RELEASE
9. Escalate to controlled access when safe detail is insufficient
Use protected review, confidentiality undertakings or sealed independent assessment when the necessary context cannot be released safely.
Controlled access should have named permissions, logging, purpose limits and a route for the appellant to respond to the reviewer’s material findings.
| Test | Failure sign |
|---|---|
| Consistency | One actor has several labels |
| Chronology | Event order is unclear |
| Authority | Roles cannot be distinguished |
| Re-identification | Rare combinations remain unique |
CHAPTER 10 OF 12 · GOVERN VERSIONS
10. Explain redaction without revealing what was removed
Describe categories withheld, the privacy reason, the context preserved and the alternative review performed.
Avoid boilerplate such as personal data removed when the omission materially shapes the appeal. The explanation must support meaningful challenge.
CHAPTER 11 OF 12 · GOVERN VERSIONS
11. Version the original, redaction plan and every release
Keep immutable source evidence, transformation rules, reviewer notes, released copies and withdrawal or correction history.
A later safer or fuller disclosure should not silently replace the copy on which an earlier decision relied.
Practical check
Write the decision, evidence and limit in three separate sentences. If one sentence depends on an unstated assumption, name it before continuing.
CHAPTER 12 OF 12 · GOVERN VERSIONS
12. Audit privacy and fairness together
Track re-identification incidents, appellant comprehension, context-loss corrections, sealed-review outcomes and repeated over-redaction by source or team.
The gold standard does not optimise for the darkest page. It protects people while preserving enough meaning for a real appeal.
| Item | Purpose |
|---|---|
| Original | Preserve evidence |
| Rule set | Reproduce transformation |
| Released copy | Show what was seen |
| Correction history | Explain later change |
Frequently asked questions
Is removing names enough to de-identify an appeal record?
Often not. Dates, roles, locations and rare events can identify people when combined.
Can redaction make a record misleading?
Yes. Removing relationships or sequence can change the apparent meaning even when every remaining sentence is literal.
When should an independent reviewer see the original?
When the evidence needed for a fair decision cannot be disclosed safely in a usable form.
Should redacted copies be versioned?
Yes. The appeal record should show which transformed copy each participant and decision-maker used.
Continue through verified routes
Core routes
Anthropology subject root · Gold Standard of Education · Gold Standard directory · How X Works hub
Specialist routes
- Evidence asymmetry, privacy-limited disclosure and independent review
- Missing-evidence incentives and burden allocation
- Evidence deadlocks and residual uncertainty
- Specialist conflicts and final decision authority