Individual attribution should be an exception with a stated reason, not the default that arrives because the data happened to contain a name.
The questions that need no names
Where is the bottleneck.
Why is the afternoon slower.
Did the new layout help.
Which product lines cause the most rework.
Where do errors originate.
How much travel does a typical order require.
Is the fleet the right size.
Practically every question a facility actually needs answered, and all of them are aggregate.
Techniques
Drop the identifier at ingestion. Retain stage, timestamp, location and work characteristics; discard who.
Aggregate at source where the system permits, so individual records never accumulate.
Group by shift, team or zone, which answers the same questions.
Pseudonymise where a linkage is needed, with the mapping held separately and access controlled — and describe it accurately, since pseudonymised data remains personal data in most regimes.
Set a minimum group size below which no figure is reported.
Round and band where precision is not needed.
The re-identification traps
Aggregation is not automatically protective.
A zone worked by one person on a shift is individual data whatever the report header says.
A small team, where the average plus one known value reveals the rest.
A time series where the rota makes the individual obvious.
Cross-referencing two reports, each safe alone.
An outlier, which is identifiable to anyone who was there.
Test your reports with someone who knows the rota, before circulating them. This takes ten minutes and prevents the whole category.
Where individual data is genuinely required
It sometimes is, and pretending otherwise means it gets collected without controls.
Safety incident investigation, where establishing what happened requires knowing who was involved.
Equipment licensing, where the record is about competence to operate.
Training and support, where someone struggling needs help — with no consequence attached.
Payroll, where premiums or piece rates apply.
In each case: narrow purpose, stated in writing, limited access, defined retention, and no drift into other uses.
Designing the pipeline
Decide the identity policy at ingestion, which is the only place it can be enforced technically.
Two streams: an aggregate stream retained long, and an individual stream retained briefly and accessible only under a defined trigger.
Access to the individual stream logged and reviewed, so that use is visible.
Automated reporting draws only from the aggregate stream.
This architecture makes the policy real rather than a rule people are asked to follow while holding the data in front of them.
The practical argument
Beyond obligation, aggregation produces better data.
People cooperate with process measurement and resist personal measurement, and their cooperation determines scan discipline, which determines whether any of it is accurate.
Gaming targets personal metrics. Nobody games a queue-length chart.
The findings are more useful, because they point at changes the operation can make.
The two-stream architecture
The design that makes the identity policy real rather than a convention.
An aggregate stream: no identifiers, retained long, feeding all routine reporting.
An individual stream: retained briefly, accessible only under a defined trigger, with access logged.
Routine reporting draws only from the aggregate stream, technically, so drift is not possible by accident.
The split happens at ingestion, which is the only place it can be enforced.
Access to the individual stream reviewed periodically against the stated purposes, with unmapped access treated as a finding.
Banding and rounding
Small techniques that reduce identifiability without losing the answer.
Report time bands rather than exact durations where the decision does not need precision.
Round counts where the trend is what matters.
Widen the time window — by shift rather than by hour — for small teams.
Combine zones where individual zones are worked by one person.
Check the combination effects, since banded cells plus a visible total can still reveal a value.