Conservative de-identification policies

Constructs a versioned field policy. These policies are technical controls, not legal determinations. A safe_harbor_candidate still requires the no-actual-knowledge and organizational review required by the applicable workflow. Pseudonymized data remain personal data when separately held information permits re-identification.

Usage

safeHarborPolicy(
  additional_fields = list(),
  date_action = c("year", "remove"),
  free_text = c("error", "drop"),
  biometric_data = c("error", "drop")
)

pseudonymizedPolicy(
  additional_fields = list(),
  free_text = c("error", "drop", "retain")
)

Arguments

additional_fields

A named plain list mapping canonical category IDs to deployment-specific aliases.

date_action

Replace person-related dates with year-only values or remove them.

free_text

Refuse, drop, or (for pseudonymized data only) retain detected free text.

biometric_data

Refuse or drop detected biometric/image content.

Value

A deidentification_policy data frame.

Examples

# A conservative field policy. The `safe_harbor_candidate` label is a
# configured-field result, not a legal de-identification determination.
policy <- safeHarborPolicy(free_text = "drop", biometric_data = "drop")
head(policy[, c("category", "action")])
#>             category action
#> 1              names remove
#> 2 substate_geography remove
#> 3         dates_ages   year
#> 4          telephone remove
#> 5                fax remove
#> 6              email remove

# The pseudonymized variant shifts dates instead of reducing them to a year.
head(pseudonymizedPolicy(free_text = "drop")[, c("category", "action")])
#>             category       action
#> 1              names pseudonymize
#> 2 substate_geography pseudonymize
#> 3         dates_ages   date_shift
#> 4          telephone pseudonymize
#> 5                fax pseudonymize
#> 6              email pseudonymize