This article covers the following data anonymity settings and processes:
- Data Anonymity
- Minimum segment size
- Data visibility threshold
- Difference anonymity level
- Comment anonymity
- Comment anonymity process
- Score anonymity process
- Topic aggregation process
See the accompanying Data aggregation settings article for:
- Time for all data setting
- Time for former employees setting
See the accompanying Time for each driver of engagement data aggregation article for:
- Time for each driver setting
All Peakon's anonymity settings are found in the Data settings section of the Administration panel, and are available for system administrators to configure.
Sections 1-4 relate to data anonymity, and sections 5-6 relate to comment anonymity.
1. Data anonymity
The anonymity levels under the Data tab control the minimum number of individual employees that must be, either part of a specific survey round, or have answered a survey over a given time period in order to have aggregate data shown. This is used to ensure the anonymity of employees. The following sections detail how this is applied.
2. Minimum Segment Size
Controls the minimum number of responses required for a segment to become available for comparison. Lower numbers mean less relative anonymity but may be required for small teams.
Example. Minimum segment size has been set to 5.
In this case it will not be possible to break down the Marketing team using the Community Marketing sub-segment, because there are not enough responses.
3. Data Visibility Threshold
The minimum number of answers for a given driver or sub-driver that must be present for the aggregated score to be calculated. This ensures that there is a minimum number of data points for the aggregated score to be visible.
Example. Data visibility threshold has been set to 4.
When looking at the Marketing team engagement drivers, the Reward driver will not show any survey data, because there were not enough survey responses on the Reward questions.
4. Difference anonymity level
The difference level controls the minimum difference in number of survey responses between two different groups of employees, where there is a large overlap in employees between the two groups.
This is used to ensure answers from small groups cannot be inferred through the difference between the scores for the groups. The difference anonymity level setting prevents segments that are too close to the context size from being visible.
For this reason, you can view this setting as a counterpart to the minimum segment size setting. While the minimum segment size hides segments that are too small to view, this setting hides segments that are too large instead.
The difference level checks are performed in three ways:
A) When filtering data by a sub-segment
B) When viewing direct reports segment
C) When viewing any segment with rights to view other segments
Note: B) and C) checks are not performed for users with access to view engagement data across the whole company. This is to ensure HR and C-level can get data for all segments and support managers in evaluating and improving their engagement score.
The first check relates to a sub-segment having so many responses that it is too close to the overall context. This creates an anonymity risk as answers can potentially be inferred by comparing the segment to the context.
Setting the difference to anonymity level protects the smaller segment from being exposed by hiding the big segment.
Example 1: A manager of 10 reports is trying to segment their data by gender. The responses are from 9 females and 1 male. The minimum segment size is 3.
Segments will be visible if they have more than 3 responses. In this scenario it will be possible to infer the scores from the male employee.
Example 2: Taking the same example, we can fix this scenario by setting the difference anonymity level to 2.
Segments in this context will be visible if they have between 3 and 8 responses. Both gender segments are hidden to protect the smaller segment.
Example 3: A company of 100 employees wants to view data based on the survey answer type, because some of the blue-collar employees are using the kiosk mode.
There are 96 employees answering the survey through email, and 4 employees using kiosk mode to answer their survey.
The minimum segment size is 5, and the difference anonymity level is 5.
Segments in this context will be visible if they have between 5 and 95 responses. Therefore it will not be possible to view data by kiosk or email employees separately.
Example 4: A company of 116 people is looking to segment data by gender. There are responses from 57 males and 59 females. The minimum segment size is 5 and the difference anonymity level is 3.
Segments in the company context will be visible if they have between 5 and 113 responses. Therefore it will be possible to split data by both gender segments.
B) When viewing direct reports segment
This check applies to a manager switching between their All Reports and Direct Reports segments.
When the difference in responses between these two segments is below the chosen difference anonymity level, the direct reports segment will not be visible.
In such cases, we always hide the smallest segment to provide the most possible data.
Example 1. Marguerite Ryan is a people manager with two segments. In her segment of direct reports there are 10 responses and her all reports segment has 12 responses. Minimum segment size is 3. Difference to anonymity is off.
Both segments are visible. It could be an anonymity risk for the two people that are not in the Direct Reports segments.
Example 2. Let's look at the same example, but with the difference to anonymity level now set to 3.
Only the All Reports segment is visible. The Direct Reports segment is hidden to protect the anonymity of the two employees that do not overlap.
C) When viewing any segment with rights to view other segments
The final check applies similarly to other segments in the context switcher.
For example, a manager has access to their Direct Reports, and they also manage the Sales Department segment. Therefore they can switch their context between the Direct Reports and Sales Department segments.
If the two segments contain the same employees, with the exception of a few employees, using this setting will ensure the smallest segment does not display any survey data.
NB. This check was added on the 8th of August 2018.
Example 1. Marguerite manages 10 people through reporting lines, and also has context access to the segment Sales Department that contains her 10 all reports, herself and one other person who reports to another manager. She can switch between the two contexts. Minimum segment size is 3. Difference to anonymity is OFF.
Both contexts are visible. Seeing as the Sales Department consists of her All Reports segment + Marguerite herself + one other employee, it will be possible for her to pinpoint that person's responses.
Example 2. To fix the above example, let's set the difference to anonymity level to 3.
Only the Sales Department context shows data, because it is the biggest of the two.
5. Comment anonymity
Comments are often the most actionable part of the feedback from employees. It is therefore important to surface as many comments as possible while preserving anonymity for each individual employee. This is particularly important on weekly or bi-weekly frequencies, where it is generally expected that a smaller part of a given segment completes the survey every round.
There are four aspects that relate to comment anonymity:
- Anonymity thresholds & display settings
- Access control permissions
- Conversations & acknowledgements
Anonymity thresholds & display settings
These settings are found under the Comments tab in the Data settings section. There are three settings relating to this:
- Segments - controls how many active employees should be in a segment to show comments within that segment
- Responses - controls how many of those active employees must have answered their survey within that round, to show comments for that specific round. The recommended value is 2 or 3, and it should typically be set at the same level as the difference anonymity level
- Date - controls whether the date displayed on comments should be the comment date or the round end date
Example. Segment threshold is set to 6, response threshold is set to 3.
Access control permissions
For managers with access to view comments, it is possible to control whether comments become visible in real-time, or only at the end of the survey round.
The Access comments in real-time permission can be found under the Comments section within each Access Control group. If it is turned ON, comments will be available in real-time. If it is turned OFF, comments for this Access Control group will only become visible at the end of the survey round.
Conversations & acknowledgements
When a conversation is started on an employee's comment, or their comment receives an acknowledgement, they are notified of this via email. The email notification is not instant, in order to further protect the employee's anonymity.
6. Comment anonymity process and considerations
The following process is followed when listing comments:
- Only answers that match a given segment are retained.
- If the number of employees that answered over the last year (this is taken from the last survey date) is less than the comment anonymity level, no comments are shown.
- Only comments from survey rounds where the total number of employees asked and employees answered are above the chosen levels are shown - this can be seen on the dashboard survey participation graph.
This process provides the following benefits:
- It ensures no comments are shown if the number of employees that responded is below the anonymity level.
- It allows access to comments in the case of high-frequency surveying without requiring a high participation rate on every round.
- It protects anonymity by ensuring that only comments from rounds where enough employees were asked are included.
7. Score anonymity process
To ensure that individual answers remain anonymous, the following process is applied after the score aggregation:
- If the total number of employees that are included across the full aggregated results is less than the anonymity level, the full set of scores is not shown.
- For each driver and sub-driver, if the total number of answers is less than the significance level, the scores for the driver/sub-driver are not shown.
This protects overall anonymity and ensures that there is a significant number of responses to each driver/sub-driver before any further analysis.
8. Topic aggregation process
Comments to include in topic analysis follows a process similar to the way engagement and driver scores are aggregated.
- Any answers from survey rounds, that are older than a year, are excluded
- Any answers from former employees, that left more than 12 weeks ago, are excluded
- Any answers for a given employee and driver/open-ended question, that are older than 12 weeks from the last answer of the employee and driver/open-ended question, are excluded.