Reporting Course Evaluations Without Exposing Students: Disclosure Control, k-Anonymity, and Differential Privacy

Bottom line up front: Most course-evaluation privacy debate stops at collection — was the survey anonymous? But the sharper risk lives at the reporting stage. A mean rating from a class of nine, a comment cross-tabulated by gender, a filter that leaves a subgroup of two: each can re-identify a student who was promised anonymity, and none of it requires a data breach. There is a mature body of technique for exactly this problem — statistical disclosure control (SDC), including rounding and suppression, k-anonymity, and, at the frontier, differential privacy. This essay explains the reporting-side threat, walks through the toolkit that national statistics agencies already use, and argues that any serious course-evaluation platform must treat safe output — not just anonymous input — as a first-class design problem.

Anonymity is not a property of the survey. It is a property of the output.

Institutions routinely tell students their evaluation responses are anonymous, and at the point of collection that is often true: no name, no student ID. But anonymity is not preserved by stripping identifiers; it is preserved only if the published statistics cannot be traced back to an individual. The distinction matters because course evaluation is unusually vulnerable to re-identification for structural reasons we set out in Anonymity, Confidentiality, and GDPR in Course Evaluation: classes are small, cohorts are known, and the reader of the report (the module lead) often knows every student personally.

Three everyday reporting moves quietly break the promise:

Small denominators. A "3.1 average from 6 respondents" in a class of nine narrows authorship dramatically. If the lecturer knows who typically speaks up, the mean plus a single free-text comment can finger an individual.

Filtering and cross-tabulation. Dashboards that let you break results down "by gender," "by year," or "by domestic/international status" are a re-identification engine. In a class with one international student, the "international" filter is a spotlight. Combine two filters and the subgroup can fall to one.

Free text plus context. A verbatim comment — "as the only wheelchair user in the lab I found the benches unusable" — is self-identifying regardless of how anonymous the survey was, and it may reveal special-category data under GDPR Article 9, a problem we examine in The GDPR Blind Spot: Special-Category Data Hiding in Your Free-Text Course Feedback.

The common thread: the danger is created at output, so the defence has to live at output too.

The established toolkit: rounding and suppression

National statistical agencies solved a version of this decades ago, and their methods transfer directly. The UK's Higher Education Statistics Agency (HESA) publishes an explicit, public rounding-and-suppression policy that is a usable template. Counts of people are rounded to the nearest multiple of 5 (any figure below 2.5 becomes 0; halves round upward). Percentages are not published when they are fractions of a group smaller than 22.5 people, and averages are suppressed when they summarise 7 or fewer people. Rounding is applied even to large figures, precisely so that differences between overlapping tables cannot be used to reconstruct a small cell. HESA makes this a condition of data use: any research output — papers, internal reports, even presentation slides — must apply the same rounding.

Translate that into a course-evaluation report and the rules almost write themselves: do not display a mean for a class below a threshold (a "rule of n", often 5 or 10); suppress subgroup breakdowns whose base is too small; round counts; and never let a chain of filters expose a cell of one or two. This is primary suppression (hiding the risky cell) and secondary suppression (hiding enough neighbouring cells that the risky one cannot be back-calculated from row and column totals). It is unglamorous, well-understood, and most evaluation dashboards simply do not do it — they will happily render an average for a class of four because no one told the software not to.

k-anonymity: a formal version of the same idea

Latanya Sweeney formalised the intuition behind suppression as k-anonymity (International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 2002). A dataset is k-anonymous if every record is indistinguishable from at least k − 1 others on the quasi-identifiers — the attributes (year, programme, gender, nationality) that, combined, could pick someone out. Set k = 5 and no combination of those attributes can isolate a group smaller than five. Sweeney's own work was motivated by a now-famous demonstration that a large share of the US population is uniquely identifiable from just ZIP code, birth date, and sex — a reminder that "we removed the name" is nowhere near sufficient.

k-anonymity gives evaluation reporting a principled rule for which cross-tabulations are safe to show: only those where every displayed combination covers at least k students. But it has a well-documented weakness that matters here. k-anonymity protects against identity disclosure while still allowing attribute disclosure: if all five students in a k-anonymous group gave the same scathing comment (the "homogeneity attack"), you learn what any one of them said without needing to single them out. That limitation is exactly why the field kept looking — and why the strongest guarantee comes from a different definition entirely.

Differential privacy: the frontier guarantee

Differential privacy, introduced by Cynthia Dwork and colleagues in 2006, reframes the problem. Instead of asking "can this output identify someone?" it bounds how much any single individual's data can influence the published result at all. Formally, a computation is ε-differentially private if adding or removing one person's record changes the probability of any output by at most a factor governed by ε. It is achieved by adding carefully calibrated statistical noise to results. The guarantee is mathematical and composable: it holds regardless of what auxiliary information an attacker has — a property plain suppression cannot promise.

This is not academic exotica. The US Census Bureau adopted differential privacy for the 2020 Census, the largest real-world deployment to date, precisely because traditional suppression was shown to be reconstructable at scale. For course evaluation the trade-off is real and worth stating plainly: differential privacy protects the individual at the cost of some accuracy, and for the tiny samples typical of a single module, the noise required can overwhelm the signal — a differentially private mean of a class of eight may be too noisy to be useful. Its natural home is aggregate reporting: institution- or programme-level dashboards, cross-year trends, benchmarking across departments — the very comparisons where re-identification risk compounds and where, as we argue in Should Universities Publish Course Evaluation Results Publicly?, the pressure to publish is highest.

But isn't this overkill for a course survey?

The honest counterargument: universities have run evaluations for decades without formal privacy machinery, and bolting Census-grade methods onto a module survey looks like solving a problem no student actually has.

Three responses. First, the absence of complaints is not evidence of safety — most re-identification is silent, felt by the student who noticed their comment was quoted and simply never wrote an honest one again. That chilling effect degrades your data quality long before it produces a formal grievance. Second, the legal ground has shifted: under GDPR, evaluation responses that can be linked to an individual are personal data, and free-text feedback can carry special-category data, so "we've always done it this way" is no longer a defensible posture. Third — and this is the real resolution — nobody is proposing differential privacy for a class of nine. The correct stance is proportionate: cheap, robust suppression-and-thresholding for module-level reports (the HESA-style rule-of-n), k-anonymity logic governing which subgroup filters are even offered, and differential privacy reserved for large aggregate and public outputs where its accuracy cost is affordable. The mistake is not over-engineering; it is doing nothing and calling the survey "anonymous" because it did not ask for a name. There is also a genuine tension worth naming: suppression protects privacy but can hide exactly the small-cohort problems — a struggling group of six — that quality assurance exists to catch. That is an argument for careful thresholds and secure aggregation, not for exposing individuals.

What safe-output design looks like in practice

A privacy-respecting evaluation platform treats safe output as a feature, not an afterthought — and this is where Koji's design choices are deliberate. Koji applies response thresholds so a module report will not render a mean or expose comments below a minimum number of responses; it governs subgroup breakdowns with k-anonymity logic so a filter chain cannot narrow to an identifiable individual; and it reserves noisier, aggregate-level reporting for the institution- and programme-level views where it is statistically sound. Because Koji's AI moderation runs the interviews, it can also flag free-text that is self-identifying or contains special-category detail before it ever reaches a module lead's screen — the reporting-side complement to careful collection. All of this sits inside GDPR/AVG-compliant, EU-appropriate data handling, with the retention discipline we discuss in How Long Should You Keep Course-Evaluation Data? so that yesterday's safe report does not become tomorrow's linkage risk.

None of this eliminates re-identification risk — a determined insider with full context can defeat almost any scheme, and every method trades some utility for protection. What proportionate disclosure control does is reduce the risk to a defensible level and surface it as an explicit design decision rather than an accident of what the dashboard happened to allow. Teams running sensitive user and customer research face the identical output-privacy problem — a verbatim quote that fingers a named account — which is why the same safe-reporting discipline runs through the main Koji platform.

The takeaway

Ask not "was the survey anonymous?" but "can anyone be re-identified from what we publish?" — because that is where the promise is actually kept or broken. The disclosure-control toolkit is mature and proportionate: rounding and suppression for module reports, k-anonymity to govern subgroup filters, differential privacy for large aggregates. Small classes deserve the same protection as large public datasets, because the student in a class of nine is more exposed, not less. A course-evaluation system that treats safe output as seriously as anonymous input is not over-engineered — it is simply keeping the promise it made when it said "your feedback is anonymous."