Comparison
AnonymisationvsData clean room
Anonymisation
you removed the id entirely and aggregated to groups of at least fifty, so no row can be traced back to a person even with the other tables.
Transforming data so that no individual can be re-identified, including by combining it with anything else. The bar is much higher than dropping the name column: quasi-identifiers like postcode, birth date and employer re-identify people with alarming reliability, so genuine anonymisation usually means aggregation or suppression. Claiming it when you have only pseudonymised is a common and consequential mistake.
Full entry →Data clean room
two companies join their customer lists to measure overlap, and neither ever sees a row from the other side.
A controlled environment where two parties can compute over combined data without either seeing the other's raw records, usually with minimum aggregation thresholds enforced. It exists because the useful question — did the people who saw our advertisement buy anything — needs both datasets and neither party may share theirs. The controls that matter are the query restrictions and the minimum group size, since without them a series of narrow queries reconstructs individual rows.
Full entry →