Home / Security and data

Pseudonymous and anonymous are two different things

A reference number used in place of a name remains personal data as long as a correspondence table exists somewhere, which can make the recipient a processor depending on its actual role rather than a simple case of anonymisation, and a pseudonymous identity on a repository needs its own local configuration.

Replacing a name with a number does not make data anonymous. According to the CNIL, consulted on 2 September 2026, pseudonymisation is processing carried out so that data can no longer be attributed to a person without additional information, but the data concerned still keeps its personal character, and the operation remains reversible, unlike genuine anonymisation.

The correspondence table changes everything

As long as a correspondence table exists somewhere, between the number and the name it replaces, the data keeps its personal character in the eyes of the law. Passing that number to an external provider then amounts to transferring personal data to them, which can make that provider a processor under the meaning of the European regulation depending on the actual role it plays with that data, rather than a simple recipient of already-anonymous data. The cautious approach is to assume that the mere existence of that table somewhere is enough on its own, even though a particular case can nuance this point depending on who actually holds that table and the means that entity has to access it. Genuine anonymisation, by contrast, removes the information so that no combination of the remaining attributes can identify the person.

A pseudonymous identity needs its own configuration

The same logic applies to an identity chosen to publish under a pseudonym on a code repository. A machine's global configuration carries its owner's real name and address, and a repository without its own local configuration silently falls back on that global identity. GitHub's documentation, consulted on 2 September 2026, confirms that a repository's local configuration takes precedence over the global configuration within that single repository, without affecting the others, and that a noreply address supplied by GitHub can replace a real address.

git config user.name
git config --local user.name "Contributeur Anonyme"
git config --local user.email "198765+contributeur-anonyme@users.noreply.github.com"
git config user.name

The first command shows the machine's global name. After the two local commands, the same command now shows the name chosen for this particular repository, without touching the configuration of the machine's other repositories.

Check from the outside, not only in the configuration

A correct local configuration is not enough if another field gives away the real identity, a fallback email left in a licence file, an author name forgotten in a metadata file. Always check from the outside, by viewing the published repository the way a stranger would, rather than from your own machine, where the real identity stays visible in other tools. The previous lesson covers what to do when a secret, rather than an identity, ends up exposed in a repository.