Assess whether a dataset is de-identified before it is shared or released
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- From the dataset description, field list, the intended recipients and the release environment, build a table of each field and combination that could identify a person, the controls proposed (removal, aggregation, access limits, contractual restrictions), and the residual re-identification risks, following the OAIC's de-identification guidance.
- What the lawyer must review
- Decide whether the re-identification risk is very low in this release context so the data is not personal information, or whether the Privacy Act still applies, settle the contractual controls with the recipient, and advise on monitoring after release.
- Written for / version
- US
Open a jurisdiction version of this task to see which instruments apply: US
Who does what
| Role | What they do |
|---|---|
| Assistance | From the dataset description, field list, the intended recipients and the release environment, build a table of each field and combination that could identify a person, the controls proposed (removal, aggregation, access limits, contractual restrictions), and the residual re-identification risks, following the OAIC's de-identification guidance. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Confirm the instructions, the jurisdiction and the complete relevant material before starting.
- Assess the risk in the actual release context, because de-identified status depends on context.
- Check combinations of fields, not only direct identifiers.
- Confirm contractual controls on the recipient match the assumptions in the assessment.
- Check the output against the source documents named in it before it is relied on.
Forms and precedents for this task
| Form or precedent | Kind | AI use | Summary |
|---|---|---|---|
| De-identification assessment record before a dataset is shared or released (Privacy Act s 6 definitions) | Checklist | AI use Yellow | Record for deciding whether a dataset is de-identified (no longer about an identified or reasonably identifiable individual) before it is shared, sold, published or used to train a model: the data, the release environment, re-identification risks, controls and the decision. |
Signed-in accounts can read the full text of each one. All precedents.
Sources
- OAIC: De-identification and the Privacy Act · 2026-10-18
These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.