Personally identifiable information in human trials

Collecting personally identifiable information (PII) in human trials carries real responsibilities that extend well beyond the study's end date. A participant who joined a trial several years ago may have had their sexual orientation, health status, ethnicity, or home address recorded. If that data is later exposed in a breach, the consequences for them could be serious. The research team's duty of care does not stop when the trial closes, and it doesn't shrink over time either: data collected a decade ago can still be re-identified using techniques that didn't exist when it was originally gathered.

What counts as PII

Some items are clearly identifiable on their own:

• Name: full name, maiden name, previous names, aliases
• Personal identification numbers: National Insurance numbers, passport numbers, driver's licence numbers, patient IDs, financial account numbers
• Address information: home address or personal email address
• Telephone numbers: personal mobile or landline numbers
• Personal characteristics: photographs, video footage, fingerprints, handwriting samples
• Biometric data: retina scans, voice signatures, facial geometry

What becomes PII in combination

Other items are not identifiable in isolation but can become so when combined with other data. A date of birth shared by thousands of people may, when combined with a postcode and a diagnosis, narrow to a single individual. This isn't a theoretical concern: it's the subject of one of the most famous studies in data privacy. Analysing 1990 US Census data, researcher Latanya Sweeney found that 87% of the population could be uniquely identified using nothing more than a 5-digit ZIP code, gender, and date of birth, three fields that feel entirely innocuous in isolation.

Sweeney didn't stop at the statistic. She demonstrated the real-world consequence directly: using only a voter registration list (publicly available, containing name, address, ZIP, birth date, and gender) cross-referenced against a supposedly anonymised state employee health insurance dataset, she re-identified the medical records of the then-Governor of Massachusetts, William Weld, and mailed them to his office. No name, social security number, or obvious identifier was needed. The combination of ordinary-looking demographic fields was enough on its own.

Fields commonly involved in this kind of combinatorial risk include:

• Date or location of birth
• Race or ethnicity
• Religion
• Employment information
• Medical information
• Educational background
• Financial circumstances
• Geographical indicators

This combinatorial risk is why data minimisation matters so much. Every additional field collected expands the potential for re-identification, and as Sweeney's work shows, the danger isn't confined to obviously sensitive fields. Ordinary demographic details, stacked together, can do the identifying work that a name would otherwise do.

What this means for study design

The practical response isn't to avoid collecting demographic data altogether, since much of it is genuinely necessary for the research question. It's to be deliberate about which combinations of fields end up in the same dataset, who has access to the full combination versus a reduced subset, and whether a given analysis genuinely needs postcode-level precision or would work just as well with a broader region.

This is also a case for thinking about your data architecture, not just your data collection form. If the analysis team needs postcode for one purpose and diagnosis for another, ask whether both genuinely need to sit in the same accessible dataset, or whether the two could be held separately and joined only under controlled conditions when a specific analysis actually requires both together. Sweeney's re-identification of Governor Weld worked precisely because separate, individually unremarkable datasets could be linked. The same principle protects you: keeping data usefully separated is a real safeguard, not just a bureaucratic inconvenience.

The most important question

Before collecting any item of personal data, ask whether you actually need it. Is it directly relevant to the research question? Will it be used in analysis? And can you guarantee it will be stored securely for as long as it needs to be retained, accounting not just for that field on its own but for what it becomes when combined with everything else you're collecting?

Collecting less is not a compromise. For most studies, given how little it actually takes to re-identify someone, it is the only defensible approach.