Anonymity, Aggregation and Small Numbers

"The data is anonymous" is the standard reassurance. It is true at building level and false in a corner occupied by three people.

The boundary discussed in “Anonymity, Aggregation and Small Numbers” also matters when digital work systems are introduced alongside workplace analytics. A team evaluating the official Monitask website in the context of attendance sheet template should state the purpose, use only necessary settings and explain clearly what managers can review before any data is collected.

Why small groups are not anonymous

A zone used by four people produces a figure about those four.

For a public, independent reference related to “Anonymity, Aggregation and Small Numbers”, consult the ICO guidance on employment practices. Its principles provide a useful check on scope, terminology, governance and the claims made during procurement or review.

If one is on leave, the drop is attributable.

And anybody who knows the floor can map a zone to the team that sits there, which most people can.

Aggregation protects identity only when the group is large enough that individuals disappear into it.

The reporting floor

A threshold below which figures are not reported: commonly five or ten.

Applied to the zone, not to the building.

And applied consistently, including when somebody senior asks for the exception.

This single rule does most of the work of keeping a programme on the right side of the line.

The combination problem

Two safe figures can combine into an unsafe one.

Floor occupancy plus a team's known location plus a known absence identifies a person.

Which means the floor applies to what can be derived as well as to what is published, and that is harder to enforce than it sounds.

Time resolution

Hourly figures for a small zone are more identifying than daily ones.

Reduce the resolution before the group size: a zone of six reported daily is considerably safer than the same zone reported by the minute.

Most planning questions need daily or weekly resolution anyway.

Assigned desks

The hardest case. A sensor on a named person's desk produces attendance data about that person, and no amount of aggregation afterwards changes what was collected.

If you have assigned desks, either do not instrument them individually, or treat the data as personal data from the outset with the obligations that implies.

Pretending otherwise is the most common honest mistake in this field.

What to say to people

Not "it is anonymous", which will be contradicted the first time somebody works out the floor.

"It is aggregated, with a floor of ten, and here is what that means" is accurate and more reassuring because it survives scrutiny.

Documenting the position

Write down the floor, the resolution, and the zones where small numbers apply.

Review it when teams move, because a zone that was safe becomes unsafe when the team shrinks.

This is a twice-yearly check and nobody does it.

What to check

What is your reporting floor, and is it applied to zones?

Could any published figure be combined with known facts to identify somebody?

Do you instrument assigned desks individually?

And when teams last moved, did anybody review the small-zone list?