Anonymizing a case: three layers and a recombination test

A case that can be traced back to its client is not a case. It is a leak with a narrative. The usual habit is to anonymize at the end, in one pass, by whoever happens to write the final paragraph: find and replace the company name, round the revenue, ship it.

The handbook rule runs the other way. Anonymization is the first gate, not the last — material is registered under its rules before writing starts, checked while writing, and checked again on the final draft. If any layer fails, the case does not need editing. It does not exist. The case itself is written to the six-section anatomy; this page decides only whether it may leave the building.

The three layers

The entity layer clears company names, people, unique product names and unique department names, along with every trace of the team that was there before. It also clears location completely: city, province, country, region, park, office tower, street. Industry, size band and product form stay.

The number layer blurs business figures into magnitudes, turns precise amounts into a magnitude plus a time range, and lets a percentage through only when it carries its sample size and its definition. Process data is the exception and stays exactly as measured: timestamps, concurrency, interface counts, call frequency. That inversion is the whole trick. The numbers that make a case useful are the technical ones; the numbers that identify it are the commercial ones.

The time layer holds a case until twelve months after the project ended, blurs time to the quarter, turns dates into "week N after go-live", and turns sequence into relative sequence.

What the item checks cannot catch

Three details can each pass every layer and still point at one company. An industry, a headcount band, and an unusual approval chain: none of the three names anyone, and together they are a fingerprint to anyone who works in that market. The three layers are item checks. Recombination is a document check, and it has to be a separate pass, run by someone who did not write the case and does not already know the answer.

The six-step pass

No pass runs on a project that ended less than twelve months ago. The clock is part of the time layer and it comes first: an eight-month-old project cannot be scrubbed into safety by anything below.

1. Register the material and tag every item. Fact, evidence, skeleton, reasonable inference, unrecorded. Nothing from a lower layer may be written as if it sat in a higher one. Pass: every claim in the draft carries a tag, and no inference is phrased as fact.
2. Sweep entities. Pass: the count of names and the count of locations are zero — not "mostly".
3. Sweep numbers. Pass: every business figure is a magnitude with a time range, every percentage carries a sample size and a definition, and every process measurement is untouched.
4. Sweep time. Pass: no calendar date survives anywhere in the text or the exhibits.
5. Test recombination. Put every surviving detail on one page and try, as an outsider, to build a route from those details to a single company. Pass: no route exists. If one does, delete the detail carrying the most identifying weight rather than the most recent one.
6. Send it to outside readers. Two or three practitioners with three or more years in the industry, none of them on the project, knowing as little as possible. Send the complete draft with no explanation and ask three questions: what industry and what size would you guess; by what route could you find this company; does it bring a specific company to mind. Record the answers verbatim, compare them with public industry information, and treat a match above 70% as insufficient anonymization — rework and rerun. If two reviews both land, the case is not published.

After approval

The client keeps a permanent right to withdraw the record. Raised in writing or in anything traceable, a published case comes down, the drafts are destroyed in electronic and paper form alike, nobody asks why, and nothing about it touches the working relationship afterwards.

The other half of the same discipline belongs to the feedback loop: a project with no evidence chain goes into the candidate pool instead of being written up anyway. A visible pool of unrecorded work is more honest than a case invented to fill the space, and it marks the edge of what the library actually knows.

A case passes when the twelve-month clock has run, the outside readers cannot name the company, and every number in it is either a magnitude or a process measurement kept as measured. Anything short of that is a draft, whatever folder it sits in.