Checking de-identified data still answers the question

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. You de-identified a survey by deleting the Name column. What should you check next?

A Nothing more, deleting Name always makes the data safe

B Check the remaining columns can still answer the original question

2. Your question is 'Which year level uses the canteen most?' You removed Name and Year Level. Is the data still fit for purpose?

A No, the Year Level column is needed to answer the question

B Yes, because the data is now fully private

3. After deleting Name, a sheet still has Full Address and Phone Number columns. What does a fit-for-purpose check tell you?

A Identifying columns remain, so remove or generalise them

B The data is de-identified because Name is gone

4. Which is the best way to scan your data after de-identifying it?

A Only look at the first column on the first sheet

B Look at every column on every sheet

5. A workbook has two sheets. You cleaned Sheet1 but forgot Sheet2, which lists student names. Is the data safe to share?

A No, Sheet2 still holds identifying data

B Yes, Sheet1 is the main sheet so it is enough

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Question: Which year level reads the most? Columns left: YearLevel, BooksRead		ARemoving one column is not enough. The student did not scan the remaining columns, such as Email or Street, which could still identify someone.
2Final scan: Sheet1 = OK, Sheet2 = Name column found, delete it		BQuestion: Do older students sleep less? Columns left: AgeBand, SleepHours
3After removing data, compare your question with the columns that are left to see if you can still answer it.		CThe remaining columns can still answer the question, so the data passes the usefulness check.
4Balance privacy and usefulness: keep what answers the question and remove anything that can identify a person.		DKeep: SleepHours, AgeBand \| Remove: Name, Email, Street
5Deleted the Name column. Done, the data is safe to share!		EScan every column on every sheet again, and remove any identifying column you find.
6Question: Which house has the most points? Columns left: Age, Hobby		FThe columns left cannot answer the question because the House and Points columns were deleted. The data is no longer useful.

Definitions

fit-for-purpose check

Fill in the Blanks

Complete each line of code by filling in the missing parts.

SELECT house, ___(points) FROM students GROUP BY house;

FOR ____ column IN sheet IF column identifies a person THEN flag column

=_________(B2:B30,"13-14",C2:C30)

SELECT _ FROM students LIMIT 3;

IF canAnswer ___ noIdentifiers THEN fitForPurpose ← TRUE

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A needed = ["house", "reads"]

B left = ["house", "reads"]

C usable = len(left) > 0

D print(usable)

Question 2

A for col in sheet.rows:

B if col can identify:

C flag(col)

Question 3

A sheets = ["Survey", "Codes"]

B for s in sheets:

C scan_columns(sheets[0])

Question 4

A question = "Sleep by age band"

B needed = ["age_band"]

C left = ["age_band", "sleep"]

D print(needed all in left)

Question 5

A missing = needed - left

B for col in missing:

C if not safe(col): add_back(col)

Answer Key

Checking de-identified data still answers the question

Section A: Quick Questions

B — Check the remaining columns can still answer the original question

A — No, the Year Level column is needed to answer the question

A — Identifying columns remain, so remove or generalise them

B — Look at every column on every sheet

A — No, Sheet2 still holds identifying data

Section B: Match the Pairs

Question: Which year level reads the most? Columns left: YearLevel, BooksRead → The remaining columns can still answer the question, so the data passes the usefulness check.

Final scan: Sheet1 = OK, Sheet2 = Name column found, delete it → Scan every column on every sheet again, and remove any identifying column you find.

After removing data, compare your question with the columns that are left to see if you can still answer it. → Question: Do older students sleep less? Columns left: AgeBand, SleepHours

Balance privacy and usefulness: keep what answers the question and remove anything that can identify a person. → Keep: SleepHours, AgeBand | Remove: Name, Email, Street

Deleted the Name column. Done, the data is safe to share! → Removing one column is not enough. The student did not scan the remaining columns, such as Email or Street, which could still identify someone.

Question: Which house has the most points? Columns left: Age, Hobby → The columns left cannot answer the question because the House and Points columns were deleted. The data is no longer useful.

Section C: Definitions

fit-for-purpose check — After removing or generalising data, check that the columns left can still answer your question and that no column can still identify a person. Scan every column and sheet again.

Section D: Fill in the Blanks

SELECT house, AVG(points)
FROM students GROUP BY house;

FOR EACH column IN sheet
  IF column identifies a person THEN
    flag column

=AVERAGEIF(B2:B30,"13-14",C2:C30)

SELECT * FROM students LIMIT 3;

IF canAnswer AND noIdentifiers THEN
  fitForPurpose ← TRUE

Section E: Spot the Error

C — Having some columns left does not mean the data can still answer the question. The check must compare the columns the question needs with the columns left: usable = needed all in left.

A — The check has to scan every column for identifying data, not the rows. It should be: for col in sheet.columns:

C — This scans only the first sheet every time. Every sheet must be scanned again, so the loop must use the loop variable: scan_columns(s).

B — The question compares sleep across age bands, so it needs both columns. If sleep is left out of needed, the check would pass even when the sleep column has been deleted.

C — If the data has lost a column the question needs, you can only add it back when it is safe (not identifying). Adding back unsafe columns brings the privacy risk back. It should be: if safe(col).