Re-identification in pseudonymised AI requests: what studies show

What does re-identification mean for AI requests?

Re-identification means that a piece of information from which the name has been removed can still be attributed to a specific person. For AI requests, this concerns the text that a pseudonymisation tool sends to an external language model. The name has been replaced, but age, place, diagnosis, occupation or an unusual event are still in the text.

An entirely invented example: a hospital has the case “Maria Müller, 43, Starnberg, rare metabolic disorder X” summarised. The tool replaces the name with “PATIENT_17” and sends the text to the model. Age, place and rare diagnosis together can still make the person identifiable.

What do the studies show?

Study	Result	What it means for AI requests
Sweeney (2000), 1990 US census	87 % of the population were likely unique based on postcode, sex and date of birth	Three harmless-looking details are often enough
Rocher, Hendrickx, de Montjoye (2019)	99.98 % of the US population could be correctly re-identified in any dataset using 15 demographic attributes	Even incomplete, “anonymised” datasets hardly meet the GDPR’s requirements for anonymity
Staab et al. (2024)	Language models infer place of residence, income or sex from texts by real people, with 85 % accuracy on the first guess and 95 % within the first three, around 100 times cheaper and 240 times faster than humans	The model itself can draw inferences even from free text; common text anonymisation did not protect effectively against this in the study
Palacios et al. (2026), 100 doctor’s letters from paediatric oncology	Off-the-shelf tools for removing patient data missed institution-specific details such as abbreviations, building names and internal identifiers; even the human reference annotations had 227 missed instances	Whatever the tool does not detect goes out in plain text

The first two studies refer to structured data from the USA. The mechanism applies generally: the more characteristics come together, the smaller the group they fit.

What routes to re-identification are there?

The guidelines on anonymisation of the European Data Protection Board (EDPB) (draft 02/2026, consultation until 30 October 2026) and the French supervisory authority CNIL examine three questions:

• Singling out: Can a person be isolated through a unique combination of characteristics? In the example: 43 years old, Starnberg, rare disease.
• Linkability: Can details be combined with other data about the same person? For AI requests, for example, when the same placeholder appears in many requests, or with public sources such as press reports.
• Inference: Can something specific be deduced about a person? According to Staab and others, language models are particularly strong at this.

On top of this come technical gaps: undetected details in free text, abbreviations, attachments or file metadata, and content that goes out via web search, tools or logs outside the actual request.

What does this mean legally?

Under Art. 4(5) GDPR, pseudonymisation is processing in such a way that data can no longer be attributed without additional information kept separately. For your organisation, the data remains personal. On 4 September 2025 (C-413/23 P), the CJEU ruled that pseudonymised data is not necessarily personal data for every recipient; what counts are the means realistically available to the specific recipient. The case was referred back to the General Court of the EU. The EDPB draft 02/2026 clarifies: where a body processes on behalf of another, the controller’s perspective applies (paras. 15 and 21). A model provider that processes on your behalf as a processor therefore receives personal data. A text can only be anonymous from the recipient’s perspective for an independent recipient that itself decides on purposes and means.

For AI requests this means: pseudonymisation lowers the risk, but in the usual set-up it does not make the request anonymous. Even with an independent recipient, what matters is not the replaced name, but whether singling out, linkability and inference are realistically ruled out for that recipient. The legal assessment is set out in the guide Is pseudonymised AI use GDPR-compliant?, and the consequences for providers outside the EU in the guide Third-country transfers with AI.

How can you lower the risk?

• Few characteristics: Send only details needed for the task; age as an age group, place as a region.
• Changing placeholders: New placeholders for each request, so that requests cannot be linked.
• Test detection: Use your own typical texts to measure what the tool misses, especially in-house abbreviations.
• Exclude rare cases: Do not process rare diagnoses, well-known people and small places via an external model.
• Clarify provider storage: How long the model provider keeps requests and who can view them.

Every restriction costs answer quality (context loss through anonymisation). For non-critical texts, a proxy can still be a sensible solution; for patient, social and citizen data, providing proof becomes laborious. Which proof you should then demand is set out in the checklist for anonymisation proxies.

How does this work with basebox?

basebox takes a different approach: the platform and the AI model run in your environment, on a server just for you or in a separate environment in our cloud, isolated from other customers, in the Munich-East data centre. By default, basebox does not send your data to any AI model of another provider, so patient data can go in without you anonymising it first. The question of whether an external recipient could identify the person then only arises with the optional app with an external model; whether you approve it for personal data is your decision, together with your data protection officer (details). The legal situation stays the same: you need a legal basis, the data processing agreement and, for professional secrecy, the agreement under § 203 StGB (German Criminal Code).

Not legal advice: This guide reflects the situation as of 11 October 2026. The EDPB guidelines on anonymisation are a draft under consultation; the final version may differ. Case C-413/23 P was referred back to the General Court of the EU. Review your use with your data protection officer.