This article covers the following data anonymity settings and processes: 

  1. Data Anonymity
  2. Minimum segment size
  3. Data visibility threshold
  4. Difference anonymity level
  5. Comment anonymity level
  6. Comment anonymity process
  7. Score anonymity process
  8. Topic aggregation

See the accompanying Data Aggregation Settings article for:

  • Time for all data setting
  • Time for former employees data aggregation setting

See the accompanying Time for each driver of engagement data aggregation article for:

  • Time for each driver setting

1. Data Anonymity

The anonymity levels control the minimum number of individual employees that must be, either part of a specific survey round, or have answered a survey over a given time period in order to have aggregate data shown. This is used to ensure the anonymity of employees. The following sections detail how this is applied.

2. Minimum Segment Size

Controls the minimum number of responses required for a segment to become available for comparison. Lower numbers mean less relative anonymity but may be required for small teams. 

Example. Minimum segment size has been set to 5.

In this case it will not be possible to break down the Marketing team using the Community Marketing sub-segment, because there are not enough responses.

3. Data Visibility Threshold

The minimum number of answers for a given driver or sub-driver that must be present for the aggregated score to be calculated. This ensures that there is a minimum number of data points for the aggregated score to be visible. 

Example. Data visibility threshold has been set to 4.

When looking at the Marketing team engagement drivers, the Reward driver will not show any survey data, because there were not enough survey responses on the Reward questions.

4. Difference anonymity level

The difference level controls the minimum difference in number of survey responses between two different groups of employees, where there is a large overlap in employees between the two groups. 

This is used to ensure answers from small groups cannot be inferred through the difference between the scores for the groups. The difference anonymity level setting prevents segments that are too close to the context size from being visible. 

For this reason, you can view this setting as a counterpart to the minimum segment size setting. While the minimum segment size hides segments that are too small to view, this setting hides segments that are too large instead. 

The difference level checks are performed in three ways:

         A) When filtering data by a sub-segment
         B) When viewing direct reports segment
         C) When viewing any segment with rights to view other segments

Note: B) and C) checks are not performed for users with access to view engagement data across the whole company. This is to ensure HR and C-level can get data for all segments and support managers in evaluating and improving their engagement score.

A) When filtering data by a sub-segment

The first check relates to a sub-segment having so many responses that it is too close to the overall context. This creates an anonymity risk as answers can potentially be inferred by comparing the segment to the context. 

Setting the difference to anonymity level protects the smaller segment from being exposed by hiding the big segment. 

Example 1: A manager of 10 reports is trying to segment their data by gender. The responses are from 9 females and 1 male. The minimum segment size is 3.

Segments will be visible if they have more than 3 responses. In this scenario it will be possible to infer the scores from the male employee.

Example 2: Taking the same example, we can fix this scenario by setting the difference anonymity level to 2. 

Segments in this context will be visible if they have between 3 and 8 responses. Both gender segments are hidden to protect the smaller segment.

Example 3: A company of 100 employees wants to view data based on the survey answer type, because some of the blue-collar employees are using the kiosk mode.

There are 96 employees answering the survey through email, and 4 employees using kiosk mode to answer their survey.

The minimum segment size is 5, and the difference anonymity level is 5.

Segments in this context will be visible if they have between 5 and 95 responses. Therefore it will not be possible to view data by kiosk or email employees separately.

Example 4: A company of 116 people is looking to segment data by gender. There are responses from 57 males and 59 females. The minimum segment size is 5 and the difference anonymity level is 3. 

Segments in the company context will be visible if they have between 5 and 113 responses. Therefore it will be possible to split data by both gender segments.

B) When viewing direct reports segment

This check applies to a manager switching between their All Reports and Direct Reports segments.

When the difference in responses between these two segments is below the chosen difference anonymity level, the direct reports segment will not be visible.

In such cases, we always hide the smallest segment to provide the most possible data.

Example 1. Marguerite Ryan is a people manager with two segments. In her segment of direct reports there are 10 responses and her all reports segment has 12 responses. Minimum segment size is 3. Difference to anonymity is off. 

Both segments are visible. It could be an anonymity risk for the two people that are not in the Direct Reports segments.

Example 2. Let's look at the same example, but with the difference to anonymity level now set to 3. 

Only the All Reports segment is visible. The Direct Reports segment is hidden to protect the anonymity of the two employees that do not overlap.

C) When viewing any segment with rights to view other segments

The final check applies similarly to other segments in the context switcher. 

For example, a manager has access to their Direct Reports, and they also manage the Sales Department segment. Therefore they can switch their context between the Direct Reports and Sales Department segments. 

If the two segments contain the same employees, with the exception of a few employees, using this setting will ensure the smallest segment does not display any survey data.

NB. This check was added on the 8th of August 2018.

Example 1. Marguerite manages 10 people through reporting lines, and also has context access to the segment Sales Department that contains her 10 all reports, herself and one other person who reports to another manager. She can switch between the two contexts. Minimum segment size is 3. Difference to anonymity is OFF. 

Both contexts are visible. Seeing as the Sales Department consists of her All Reports segment + Marguerite herself + one other employee, it will be possible for her to pinpoint that person's responses.

Example 2. To fix the above example, let's set the difference to anonymity level to 3. 

Only the Sales Department context shows data, because it is the biggest of the two.

5. Comment anonymity 

Controls the minimum amount of employees a survey is sent to before displaying comments. 

Comments are often the most actionable part of the feedback from employees. It is therefore important to surface as many comments as possible while preserving anonymity for each individual employee. This is particularly important on weekly or biweekly frequencies, where it is generally expected that a smaller part of a given segment completes the survey every round.

Example. Comment anonymity level is set to 5

The Sales team will only be able to see segment-specific comments on the Sales Development Representative segment. The other comments will not be visible in their segments, because not enough employees were asked to complete the survey. These comments, including Sales Development Representative comments, will be available in the overall Sales segment.

6. Comment anonymity process and considerations

The following process is followed when listing comments:

  1. Only answers that match a given segment are retained.
  2. If the number of employees that answered over the last year (this is taken from the last survey date) is less than the comment anonymity level, no comments are shown. 
  3. Only comments from survey rounds where the total number of employees asked are above the comment anonymity level are shown - this can be seen on the dashboard survey participation graph.

This process provides the following benefits:

  • It ensures no comments are shown if the number of employees that responded is below the anonymity level.
  • It allows access to comments in the case of high-frequency surveying without requiring a high participation rate on every round.
  • It protects anonymity by ensuring that only comments from rounds where enough employees were asked are included.

7. Score anonymity process

To ensure that individual answers remain anonymous, the following process is applied after the score aggregation:

  • If the total number of employees that are included across the full aggregated results is less than the anonymity level, the full set of scores is not shown.
  • For each driver and sub-driver, if the total number of answers is less than the significance level, the scores for the driver/sub-driver are not shown. 

This protects overall anonymity and ensures that there is a significant number of responses to each driver/sub-driver before any further analysis.

8. Topic aggregation

Comments to include in topic analysis follows a process similar to the way engagement and driver scores are aggregated.

  1. Any answers from survey rounds, that are older than a year, are excluded
  2. Any answers from former employees, that left more than 12 weeks ago, are excluded
  3. Any answers for a given employee and driver/open-ended question, that are older than 12 weeks from the last answer of the employee and driver/open-ended question, are excluded.

Article: Data aggregation settings

Article: Time for each driver of engagement data aggregation article

Did this answer your question?