How to Truncate people's names on Public Display?

Question

We are developing a Public Display Activity Feed for our system and have encountered some privacy concerns. To resolve this, we want to truncate people's names by First Name, Last Initial however it's difficult to discern how to do so. Due to the variations of names, we only have one Name field on sign up, and not First and Last Name fields.

Question: How to Truncate names respectfully?

Considerations:

• User last names may have spaces in them (example: Someone Van Something)
• We do not have eastern users of the product so First and Last names are not in reverse order.
• We do not have an alternate "username" in our system. Most use their real names.
• Our system captures names in a single field to accommodate for different conditions such as titles and doctorates. For example: "Sir John A MacDonald PhD". This makes it difficult to create universal parsing rules.

Answer 1

In many sets of people names (e.g. employees in a company), there will be at least one given name that is unique and there will also be at least one unique family name. There will be even more unique combinations when an initial is added, i.e. G. Family (e.g. Gil and Gale) and Given F. (e.g. Fitzgerald and Franklin). You’ll always run into the problem that either someone can identify a person by their pseudonym or that several activities will be posted with the same identifier, although they stem from different users.

One privacy-save solution is to display only arbitrary avatars generated from the full name string, like the little green pattern next to yours. They are known as ‘identicons’, ‘wavatar’, ‘monsterid’ etc. I don’t know whether there’s one that generates comic faces wich would be easy to recognize when they appear multiple times (and from your own private profile page), but there certainly are generators for textual bogus names, although they’re themed to be funny (gangster, pirate, musician, indian …) and hence usually inappropriate for a serious setting.

However, if you really want to use truncation on the full names, you could try initials only: GF, SVS. There’ll be lots of duplicates, but someone may still recognize themself when seen next to the activity. You could also parse and concatenate certain parts of names, e.g. first consonants and following vowels:

• Barack Obama → BO | Bao | Bala | Old Melon Balls | Cap’n Wallace Jellybones | …
• George Walker Bush → GWB | Geowabu | Geoqush | Dances With Monkey Hunta | Frownin’ Wally Dawkins | …
• Bill Clinton → BC | Bicli | Bikon | Cow-Tippin Chinaman | Tennis Elbow Burt | …
• George H. W. Bush → GHWB | Geobu | Geonush | Swingin Jamaican | Pirate Dan the Black | …
• Ronald Reagan → RR | Rorea | Rolan | Slimy Couch Bouncer | “Snafu” Jake Read | …
• Jimmy Carter → JC | Jica | Jiler | Sherman Tank Daddy | Hobblin’ Javier Grimm | …
• Gerald Ford → GF | Gefo | Gehord | Dead Bully Scratchy Nutz | Smarmy Quincy Kidd | …
• Richard Nixon → RN | Rini | Rilon | Threepac G-Ride Bouncer | Pear-Shaped Isaac | …
• …

There are certainly other hashing functions.

Answer 2

You should probably just change the fields to first and last name. But if your goal is anonymity, change the field to first name rather than just name and use the first name.

Answer 3

It is impossible to do it automatically. There are many naming schemes around the world, and a person's name may look very differently depending on where they are from. And as you noticed, people also use titles.

You will have to leave this one to the users. Ask them for a "Name variant to be displayed in privacy sensitive contexts" or similar. You can show a rule as an example, saying something like

E.g., if you are called John Doe, you can enter John D.

but don't call the field "First name and initial" because this creates the same problems as the ones which would stump an automatic parser - only unloads them on your poor user. Max Mustermann will easily understand what "first name and initial" means, but a Spanish user with two family names, or an Indian user without a family name, or a Japanese user who uses the family name first, will be confused, and afraid to enter something wrong. Explain to them what the name will be used for, so they can make an informed decision, instead of wondering how to handle exceptions of your arbitrary rule.

Answer 4

This is a surprisingly common problem, and you'll find that you can't have everything.

Is privacy an everyday issue? Then you need to make them choose an everyday handle that's guaranteed to be noticeably unique within your system, and that's how they'll be known.

If it's an issue only with particular activity, then a special system-unique pseudo-anonymous handle will work. It should be system-generated to reduce de-anonymising bias and human-readable to reduce stress, but you can give them a choice of several so they'll feel ownership.

If the people who will be protected aren't actually involved personally in the system (I can't tell from your description), e.g., you're publishing their research or something, then you need to have a function that will take whatever identifier they use and anonymise it uniquely, for example by hashing it and then using the individual elements of the hash to index a lookup table from with human-readable words or syllables are picked to form the actual anonymous handle.

If they are involved personally, and the identifier will be public, you can get around the variations in name-construction by first picking up on their culture and sex membership, and then providing appropriate cues, e.g. ask a Zulu-culture man for his praise name rather than his given name. If the identifier must be their name AND must be unique, then all you can do is append or prepend (their choice) some unique token, e.g. a serial number, when there's a collision.