In 2026, many municipalities and government organizations are still grappling with the processing of Open Government Act (Woo) requests. The workload is intense, and both the Dutch Data Protection Authority (AP) and the European Data Protection Board (EDPB) continue to tighten privacy requirements. With the publication of the latest EDPB guidelines on anonymization in July 2026, a persistent pain point has become more urgent than ever: puzzle identification.
Redacting directly identifying information—such as names, addresses, and citizen service numbers (BSN)—is simply no longer sufficient. The current Woo request anonymization rules require administrative bodies to also mask unique contextual characteristics. For the public sector, this means data processing and anonymization must go far beyond placing digital black bars over names.
The Risk of Contextual Traceability
In puzzle identification, also known as indirect traceability, readers can deduce an individual's identity by combining various pieces of information. Imagine a municipality redacts the name of an employee or external consultant in a Woo decision, but leaves the job title, specific department, and a rare project date visible. An attentive citizen or journalist could easily track down who this is via public council documents or LinkedIn. In that scenario, the data is pseudonymous at best, not anonymous. Under the GDPR, this poses an immediate privacy risk.
Regulators specifically warn against this form of traceability. In 2026, administrative bodies must structurally demonstrate that they secure not just isolated data points, but the entire context of a document before making it public.
Why Manual Redaction Falls Short
This heightened focus on context makes the traditional, manual redaction process unsustainable. A civil servant manually scanning hundreds of pages of unstructured emails, internal memos, and WhatsApp messages will inevitably miss subtle connections scattered throughout the text. Furthermore, statutory decision deadlines are compromised when files become too labor-intensive.
As we previously discussed in our article on accelerating Woo decision-making with AP-proof safeguards, the current scale of information requests demands advanced automation. However, a simple algorithm that filters names purely via regular expressions or predefined keyword lists no longer meets modern standards for contextual security.
Context-Aware Anonymization with BEVER
To tackle the unique complexity within the public sector, we developed the AI agent BEVER. BEVER is specifically designed to accelerate Woo decision-making while simultaneously mitigating strict GDPR risks through context-aware anonymization.
Rather than searching for isolated words, the underlying language model analyzes the semantic structure of the entire document. BEVER actively recognizes:
- Patterns in behavior and function: Descriptions of specific tasks or unique incidents that can indirectly be traced back to a single official or citizen.
- Combined data points: Sequences of data—such as a date, geographical location, and a specific pay scale—that collectively form a unique profile.
- Cross-document consistency: The system detects when the same project or person is discussed across thirty different documents and applies uniform masking to eliminate traceability via cross-referencing.
By leveraging specialized AI Services like BEVER, the Woo jurist's role shifts from execution to validation. The agent takes over the bulk of complex pattern recognition, flags privacy risks, and provides the jurist with a contextually cleansed draft for approval. This guarantees the transparency required by the Woo without compromising on compliance.
Sources:
- Dutch Data Protection Authority (AP), Pseudonymising Data & EDPB Anonymization Guidelines
- VNG, Guide to the Open Government Act in Municipal Practice (2026)
- Central Government (Rijksoverheid), Dossier Open Government Act (Woo)
Would you like to know how the BEVER agent can support your municipality in processing Woo requests efficiently and in a GDPR-compliant manner, without the risk of puzzle identification? Contact us for a no-obligation demonstration of context-aware AI anonymization in practice.