Which of the following is not a category of identifiability set out in TCPS 2?

• A. Indirectly identifying information.
• B. Anonymized information.
• C. Coded information.
• D. Secret information.

Answer: (D)

In TCPS 2, privacy risk is assessed by how easily data can be linked to a person. Indirectly identifying information refers to data that alone doesn’t reveal identity but could do so when combined with other data sets. Anonymized information means all direct identifiers have been removed and the person cannot reasonably be identified from the data itself. Coded information involves removing direct identifiers and replacing them with a code, with a separate key kept by a researcher that could re-link the data to the individual if needed. Secret information is not a recognized category of identifiability in TCPS 2; the framework focuses on how data can identify or be linked to individuals, not on a notion of “secret” status. So the option that doesn’t fit as a category is secret information.