Research
What counts as identifying information in a client document?
Two kinds of detail identify a person. Direct identifiers point to one person on their own: name, street address, email, phone, and ID numbers such as a SIN, passport or account number. Quasi-identifiers identify in combination: date of birth, postal or ZIP code, city, employer, occupation, income. Published standards remove the first kind outright and reduce the second, because a rare job plus a small place can name someone without a name.
Key takeaway: Removing names is not enough. Address-scale locations, full dates of birth and employers identify people too.
Last reviewed · 9 sources
Direct identifiers: remove them
Ontario's Information and Privacy Commissioner defines direct identifiers as variables that "can be used to identify a single individual, either by themselves or in combination with other readily available sources of information", with name, address, email address and telephone number as examples.
Canada's federal Privacy Act lists "any identifying number, symbol or other particular assigned to the individual" as personal information. For a client file, that means SINs, UCIs and IRCC file numbers, passport and driver's licence numbers, US SSNs, A-numbers and EINs, health card numbers, and financial account numbers.
Quasi-identifiers: reduce them
The same IPC guidance lists quasi-identifiers including "gender, date of birth or age, event dates", "locations (e.g., postal codes, building names, regions)" and "profession". The UK ICO names "sex, age, occupation, place of residence, country of birth" as key variables to mask or tokenise.
HIPAA's Safe Harbor method is the most concrete list: it removes names, "all geographic subdivisions smaller than a State" including city and ZIP code (with a narrow three-digit exception), and "all elements of dates (except year)" directly related to the person. It applies to identifiers "of the individual or of relatives, employers, or household members".
How the standards line up
| Detail | Treatment in the standards | Where it comes from |
|---|---|---|
| Name, email, phone, street address | Remove | IPC Ontario direct identifiers; HIPAA Safe Harbor |
| SIN, passport, account and other ID numbers | Remove | Privacy Act s. 3 (identifying number); HIPAA Safe Harbor |
| Full postal code or ZIP code | Remove (address-scale) | Statistics Canada: about 19 households per postal code; HIPAA Safe Harbor |
| City | Remove | HIPAA Safe Harbor names city; StatCan public microdata keeps only province |
| Province or state | Usually kept | HIPAA removes only units smaller than a State; FRCrP 49.1 allows city and state |
| Full date of birth | Remove the date, the year can stay | HIPAA keeps year only; FRCP 5.2 allows the year of birth |
| Employer | Remove | HIPAA covers identifiers of employers; Privacy Act covers employment history |
| Occupation, income | Keep if ordinary, reduce if rare | Listed as quasi-identifiers by IPC Ontario and the ICO |
Summarized from the sources below, opened 25 September 2026. Standards written for releasing datasets are a guide for one document, not a rule for it.
Why one document is different from a dataset
Most of these standards govern releasing many records to strangers. A single client document sent to an AI provider is one detailed record, so anonymity is out of reach; the realistic goal is to remove direct identifiers, reduce quasi-identifiers the task does not need, and keep the facts it does. The Barreau du Québec puts the second half plainly: limit what you share to what is "strictement nécessaire" for the tool to do its task.
Where PiBye fits
How PiBye handles this
PiBye replaces direct identifiers and address-scale details (names, ID numbers, addresses, full postal and ZIP codes, dates of birth) with consistent tokens on your Mac. You review every replacement and can add or keep items, which is where rare occupations and outlier amounts get their second look.
1.0.1 · macOS 14.8.5 or later · Apple Silicon · 1.1 GB
Frequently asked questions
Is a job title identifying?
Usually not on its own. A generic title such as nurse or cook is shared by many people; a singular role tied to an institution, such as the head of a named organization, can identify someone by itself.
Are dollar amounts personal information?
They can be sensitive: the OPC says income records are almost always considered sensitive. They rarely identify someone on their own, and many legal and tax tasks depend on them, so keep them only when the task needs them.
Sources
- De-identification Guidelines for Structured Data, Information and Privacy Commissioner of Ontario, June 2016. Checked 25 September 2026.
- Privacy Act, section 3 (definitions), Justice Laws Website, Government of Canada. Checked 25 September 2026.
- 45 CFR § 164.514: other requirements relating to uses and disclosures of protected health information, Legal Information Institute, Cornell Law School. Checked 25 September 2026.
- Federal Rules of Civil Procedure, Rule 5.2: privacy protection for filings made with the court, Legal Information Institute, Cornell Law School. Checked 25 September 2026.
- Federal Rules of Criminal Procedure, Rule 49.1: privacy protection for filings made with the court, Legal Information Institute, Cornell Law School. Checked 25 September 2026.
- 2006 Census Dictionary: Postal code, Statistics Canada, 2006 Census reference (archived). Checked 25 September 2026.
- 2011 National Household Survey Public Use Microdata File: confidentiality, Statistics Canada. Checked 25 September 2026.
- How do we ensure anonymisation is effective?, Information Commissioner's Office (UK). Checked 25 September 2026.
- Foire aux questions : intelligence artificielle générative, Barreau du Québec. Checked 25 September 2026.