conclusions may be drawn without identification

Consider for a moment general practice medical records, which are presently stored in 10 000 systems of around a dozen different sorts in a like number of places.

A question such as "How many people have Diabetes, of which types, by age and sex distribution and what medicines are they prescribed?" can be approached in at least two ways.

One way is to construct a large computer system notionally placed in Richmond House, Whitehall, suck all information from the 10 000 systems into it, and then make an SQL query against it.

Another way is to write two lines of Perl for each of those dozen sorts, which launch a (possibly SQL, possibly M, possibly procedural) query against the system to produce an answer, a small table of figures, ship that to a rather smaller computer notionally in RIchmond House and with another two lines of Perl aggregate them into a table of figures.

The first is more popular with the suppliers of large, and rather fanciful, computer systems, the civil service, and allegedly MI5. The latter has certain advantages, such as being known to be possible, easy even, cheap and as a small but topcially relevant feature, of not transferring identities from here to there or concentrating them into one place.