PRODUCTION SCENARIO
A hospital network wants analysts to study readmissions across three BigQuery datasets. Policy forbids exposing patient IDs to the analytics team, and the analysts still have to join the three datasets on the same patient.
Which privacy technique meets both requirements?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Pseudonymization, which swaps each ID for a token
Pseudonymization swaps a sensitive value for a cryptographically generated token, and because the same input always produces the same token, primary keys still line up across tables. Google documents this exact use: replace customer IDs and primary keys with consistent tokens so teams can join and aggregate in BigQuery without exposing the identifier. Anonymization is the near miss to know, because its values are deliberately unrepeatable, so the three datasets stop lining up on the same patient. Redaction removes the column entirely and takes the join with it. Aggregation protects individuals by reporting group counts rather than rows, which is sound for a different question and cannot support a record-level join.