Can a Student Be Re-Identified From Their Course Feedback? Small-Class Anonymity, k-Anonymity and GDPR

Answer in brief. A course evaluation that removes names is not automatically anonymous. Re-identification research shows people are routinely singled out from a few combined attributes (Sweeney''s classic result: roughly 87% of the US population is uniquely identifiable from ZIP code, date of birth and sex alone), and the same logic applies when a small cohort is cross-tabulated by programme, gender or nationality, or when a distinctive open-text comment is quoted. Under the EU GDPR (Recital 26), data is only "anonymous" — and outside the Regulation — if re-identification is not reasonably likely by any party using all means reasonably likely to be used; otherwise it is merely pseudonymous personal data and still fully protected. The practical safeguards are minimum-response thresholds (a k-anonymity-style rule), suppression of small cells, careful handling of quotes, and never linking demographics to open text in a small class.

What the research says

The foundational finding is Latanya Sweeney''s work on unique identifiability. In Simple Demographics Often Identify People Uniquely (Carnegie Mellon, 2000) she showed that about 87% of the US population could be uniquely identified by the combination of five-digit ZIP code, date of birth and sex — none of which is a "name," yet together they are a fingerprint. This motivated her formal privacy model, k-anonymity (Sweeney, 2002, International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 10(5), 557–570): a data release satisfies k-anonymity if every combination of the quasi-identifiers (the attributes an adversary might know, like programme + year + gender) appears for at least k individuals. If k = 1, someone is unique and trivially re-identifiable; the larger k, the more people any given profile could be, and the lower the probability of a correct re-identification (at most 1/k).

Sweeney and later authors are also clear about k-anonymity''s limits. It protects against identity disclosure but remains vulnerable to homogeneity attacks (if all k people who share a profile also share the sensitive answer, knowing the profile reveals the answer) and background-knowledge attacks (an adversary who knows one extra fact narrows the set). These weaknesses motivated stronger models such as l-diversity and t-closeness, but for the modest scale of course evaluation, k-anonymity thinking is the right first-line discipline.

That the risk is real, not theoretical, is documented by El Emam, Jonker, Arbuckle and Malin (2011), "A systematic review of re-identification attacks on health data," PLoS ONE, 6(12), e28071, which catalogues successful re-identifications of supposedly de-identified datasets and stresses that risk depends on context and available auxiliary information — exactly the situation inside a university, where staff often do know who is in a class.

On the legal side, the anchor is the GDPR. Recital 26 states that the principles of data protection do not apply to anonymous information, but that to determine whether a person is identifiable "account should be taken of all the means reasonably likely to be used, either by the controller or by another person," considering cost, time and available technology. The Article 29 Working Party Opinion 05/2014 on Anonymisation Techniques operationalised this, warning that pseudonymisation is not anonymisation and that singling-out, linkability and inference must all be prevented before data can be treated as anonymous. In other words: stripping the name does not take course-evaluation data out of GDPR if a colleague could still reasonably work out who wrote a comment.

Why it matters for course evaluation in practice

The promise of anonymity is what makes students answer honestly — see our note on whether anonymity makes students more honest. Break that promise, even inadvertently, and you damage both response quality and trust, and you may breach data-protection law.

• Small classes are the danger zone. In a seminar of eight, "the international student who mentioned the Tuesday lab" is identifiable to the tutor from a single comment. Any demographic breakdown (by gender, nationality, disability status) of such a cohort risks k = 1 cells.
• Cross-tabulation quietly destroys anonymity. Each additional filter — programme × year × gender — shrinks the group until individuals are unique. Reporting dashboards that allow arbitrary drill-down are a re-identification engine.
• Verbatim quotes carry identifying detail. Idiolect, referenced events, and specific complaints can single a student out even when no demographic field is attached.
• The evaluator is often the adversary. Unlike an external data release, course feedback is read by the very person with the most background knowledge — the instructor — which makes the "means reasonably likely to be used" test in Recital 26 far easier to meet than institutions assume.
• It is a compliance obligation, not a courtesy. For European institutions, mishandling identifiable feedback is a GDPR matter, and the audit trail belongs in your quality documentation — see turning student feedback into ESG/ENQA evidence.

Limitations and honest caveats

• k-anonymity is a floor, not a guarantee. As above, homogeneity and background-knowledge attacks can defeat a technically k-anonymous release. A threshold rule reduces risk; it does not prove safety.
• Thresholds trade off against usefulness. Suppressing every cell below, say, five responses protects students but can starve a small programme of any feedback signal at all. There is a genuine tension between confidentiality and the formative value of the data, and it must be decided deliberately, not by default.
• "Reasonably likely" is a judgement, not a formula. GDPR''s standard is contextual; what is anonymous in a 400-student cohort is identifying in a class of six. No fixed k is correct everywhere.
• Free text is hard to anonymise. Redacting identifying detail from open comments is labour-intensive and imperfect; automated redaction can miss context-specific tells. This is an active-diligence problem, not a solved one.
• Aggregation can still leak. Publishing means for very small groups, or differences between overlapping subgroups, can allow inference back to individuals even without raw data.

How Koji incorporates this

Koji for Education is designed for European higher education, where GDPR is a first-order constraint, and its reporting is built to respect small-cohort confidentiality rather than to maximise drill-down.

• Threshold-based reporting (k-anonymity in practice). Koji is designed to suppress or withhold breakdowns when a subgroup falls below a minimum-response threshold, so a dashboard cannot render a k = 1 cell that fingerprints a student. This operationalises the k-anonymity discipline the research recommends.
• Bias-aware, aggregate-first reporting. Rather than exposing every demographic cross-tab by default, Koji emphasises cohort-level themes and quality-scored summaries, reducing the linkability and singling-out that the Article 29 guidance warns against.
• Thematic synthesis over raw quote-dumping. Koji''s automatic thematic analysis lets an institution act on what students collectively said without surfacing individual verbatim comments that carry identifying detail — and where a quote is used, it can be summarised or generalised rather than reproduced with its identifying specifics.
• Structured questions reduce accidental identifiers. By capturing much feedback through structured question types (scale, single_choice, ranking) alongside probed open text, Koji reduces reliance on free-text fields that are the hardest to anonymise.
• Designed to support, not certify, compliance. Koji provides mechanisms that help institutions meet their obligations; it does not remove the controller''s duty to set appropriate thresholds and judge the "reasonably likely" standard for their own context. The determination of what is anonymous under Recital 26 remains the institution''s.

Koji''s core research platform at koji.so applies the same threshold-aware, aggregate-first reporting to product and customer research, where re-identification from small segments and quoted verbatims is an equally live privacy risk.

Related resources

• Does Anonymity Make Students More Honest? Social Desirability and Course Feedback
• Does a Conversational Course Evaluation Make Students Less Honest? Mode Effects and Social Desirability
• Abusive Open-Text Comments in Course Evaluations: The Evidence and the Duty of Care
• How Many Responses Do You Need for a Reliable Course Evaluation?
• What Can Open-Text Student Comments Tell You That Likert Scores Cannot?
• Turning Student Feedback into ESG / ENQA Accreditation Evidence

A practical disclosure checklist

Turning the research into routine practice is mostly a matter of a few standing rules. First, set a minimum-response threshold below which no result is reported — many institutions use a floor of five responses — and never display a subgroup breakdown that would fall below it. Second, forbid open-ended cross-tabulation in dashboards for small cohorts: allowing a reader to filter by programme, then year, then gender is exactly how a safe aggregate becomes a k = 1 cell. Third, treat verbatim quotes as the highest-risk output — paraphrase or generalise them, strip references to specific events, dates and locations, and never pair a quote with demographic labels in a small class. Fourth, suppress small cells in every published table, not just in the raw data, because differences between overlapping subgroups can leak individual values through inference. Fifth, document the judgement: record what threshold you set and why it is appropriate for the cohort size, so you can show an auditor that you weighed the "reasonably likely" standard rather than assuming anonymity. None of these steps is technically hard; the failure mode is almost always a well-meaning dashboard that offers more granularity than a small class can safely bear.

References

• Sweeney, L. (2002). k-anonymity: A model for protecting privacy. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 10(5), 557–570. https://doi.org/10.1142/S0218488502001648
• Sweeney, L. (2000). Simple demographics often identify people uniquely (Data Privacy Working Paper 3). Carnegie Mellon University. https://dataprivacylab.org/projects/identifiability/paper1.pdf
• El Emam, K., Jonker, E., Arbuckle, L., & Malin, B. (2011). A systematic review of re-identification attacks on health data. PLoS ONE, 6(12), e28071. https://doi.org/10.1371/journal.pone.0028071
• Article 29 Data Protection Working Party. (2014). Opinion 05/2014 on Anonymisation Techniques (WP216). European Commission. https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp216_en.pdf
• Regulation (EU) 2016/679 (General Data Protection Regulation), Recital 26. https://gdpr-info.eu/recitals/no-26/