What is data de-identification in a company data license?
The short answer
Data de-identification means taking names and details out of records. It does not settle who owns the rights. In California, the data must not link back to a person. The business must publicly promise to keep it that way. Every buyer must sign on too.
Search results for this phrase are mostly health-privacy pages and software vendors. We're covering it for an owner with an email, chat or ticket archive to license.
In plain words
De-identification removes or swaps the details that point to a person.
Think of it like this
It's like pulling the name tags off the boxes in the attic. A name written inside a box still points to someone.
What do the laws mean by de-identified?
The tests differ by law, and each has its own text.
California. Under the CCPA, deidentified information "cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer."
The business must also take reasonable measures, publicly commit not to re-identify, and bind recipients by contract (Civil Code 1798.140(m)). Without that, a transfer of personal information for money or other valuable consideration counts as a sale.
Health information under HIPAA. The rule offers two methods. One is an expert determination. The other is a safe harbor that removes 18 types of identifier (45 CFR 164.514).
UK. The ICO says pseudonymised data is personal data in the hands of anyone who holds the additional information. It marks its guidance as under review (ICO).
FTC. In July 2024 the FTC wrote that hashes "aren't 'anonymous'" and can still identify users (FTC).
Why isn't de-identification enough by itself?
Daniel Goldberg, a partner at Frankfurt Kurnit, wrote that removing identifying details from millions of emails and chats is "much harder than removing names from structured fields."
He added that de-identification speaks to whether a record can be linked to a person. It does not speak to whether the content is confidential. He advised excluding high-risk data instead of relying on it (Frankfurt Kurnit).
Handshake AI's own page says a third party may be able to re-identify personal information in combination with other data.
Who does the de-identifying in a deal?
It varies by firm. micro1 staff said in an undated recorded forum talk that the company transforms the data itself. The same talk said redacting first would destroy the cross-tool trail it needs. This is self-reported.
In the Spirit sale, the court-appointed privacy ombudsman's report says the debtors hired Tonic.ai to de-identify unstructured data.
Before each transfer Tonic.ai is to deliver a certification, filed with the court, that the approved procedures ran. The ombudsman did not examine risks to employees or third parties (ombudsman report, Doc 1684).
The sale agreement asks for de-identification that preserves "referential integrity across the data set." The flight attendants' union challenged that (Time).
In the same talk micro1's David Revland, who works on human data, said micro1 swaps each name for the same stand-in every time, which keeps the links between records. A union made the same point about the Spirit sale, so ask any buyer how it handles links.
What should an owner ask?
- Who does the de-identification, and who pays for it?
- To what standard, and does anyone certify it?
- Do links between records survive, and why?
- May we scrub first?
Run the rights check and read the risk map before a buyer call. Talk to a privacy or commercial lawyer in your state before you sign.
Apply to micro1's data partnership (paid link)micro1's own data-partnerships pagePaid link: micro1 may pay us a referral fee if a company we introduce goes ahead with it. You pay nothing extra.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
