Your LimeSurvey version: Version 3.5.1+180312
Own server or LimeSurvey hosting: Own server
Survey theme/template:
==================
Hello everyone,
we are currently implementing a survey. The survey should be anonymous. The problem is that we have two questions (lets call them Question A and Question B ) that together could enable deanonymisation. We would still like to obtain the information of these two questions. So my question is: Is it possible to "split" the answers of the participants? So that we obtain two data points for each participant, one containing the answer to question A and all the other questions except B (so A, C, D, E...) and one containing the answer to question B and all the other questions except A (so B, C, D, E...), and therefore guaranteeing anonymisation.
I would be thankful for any help in this matter!
 

Anonymity is always a construct that depends on your interpretation and implementation of anonymity.

In market research we promise our respondents that their data will be analyzed anonymously, even if we collect personal data within the research. This works very well form decades now. Before we removed the front page of the questionnaire with the personal data of a respondent when the questionnaires entered the institute, today you seperate the personal data from the response data within the data file. Usually there is still an ID that connects both.

So in theory we could connect their personal data with their responses, but based on our code of conduct we separate personal data from response data when analyzing. We never analyze responses together with personal data of respondents.

Sometimes it is just necessary to be able to connect the personal data with the responses for a variety of reasons: follow up surveys with connection between the two data points, quality control (get in touch with the respondent and check if they have been interviewed, provide prizes and incentives, etc. Yet the survey is still considered anonymous, even if we could connect the information to a person if we want to.

Why am I writing all this? Because "technical" anonymity is tricky and there are always loopholes that make things not as anonymous as we might think.

It all depends on how you want to analyze the data. If you do not need to analyze answers to question B together with any other question, you can ask question B in a separate survey that is connected to the first survey via end url without passing on any ID from the first survey.

However, this only works if question B can be disconnected from any other question. But from what I understand, you need B to come after A and before C, correct?

So I don't see how you can fully separate these data sets technically to guarantee 100 anonymity.

You can create two different exports of the survey results, one excluding question B, the other one excluding question A. However, this also does not guarantee 100% anonymity. If you have both files, it is relatively easy to aline the responses to question C, D, E, etc. to connect both data sets again. And you still have the ability from within Limesurvey to export the whole data set.

So we are back full circle to "ethical" anonymity. It is up to the team of analysts on how to treat the data ethically, as 100% technical anonymity often can't be guaranteed.

Your respondents need to trust you, that you won't connect personal data with the results. If they don't trust you (e.g. the HR department of the company is running the survey), give the survey out to a third party that guarantees not to pass on information about who responded what.

As an example: even the anonymous mode in Limesurvey is not that anonymous. Per default, you can't export the responses together with the data from the token table. However, you can still pass on data from the token table to the survey and thus make the connection later manually.

Your LimeSurvey version: Version 3.5.1+180312

And before worrying about anonymity when analyzing data, you should be worried running an awfully out of date installation of Limesurvey and collecting data with it.

Your version of Limesurvey was released on 12/03/2018, so for over 5 years now it hasn't received any updates, bug fixes or security patches.

So guaranteeing some anonymity based on two questions in a questionnaire is the least of your problems.

In the light of data protection laws like GDPR/DSVGO, LGPD, etc. you should keep your installation of Limesurvey as up to date as possible. I don't think a judge would consider a software that hasn't received updates for 5 years as "state of the art".

Thank you very much for your extensive answer. For our case we need to ensure "actual" anonymity, so we have decided to drop out the questions that could make deanonymisation alltogether. We lose some information there obviously but it is better than having to get parental consent for every participant the survey (our respondents our minors), which is a necessary (and reasonable though effortful) step according to GDPR. Thanks anyway!

Yes thank you for pointing that out. We will definitely update Limesurvey.