A while ago, I cottoned on to the (pretty obvious, in retrospect) fact that even if you are not sharing a piece of information in plain text, if it can be derived from your dataset, it counts (ethically, and probably according to your IRB/equivalent body of choice) as sharing that info. I thought I had successfully handled this wrinkle in my data sharing, but I found out I hadn't.
I collect three types of personally identifiable information (PII) in my research:
Video of the children who participate in my studies, primarily so I can check that paradigms are being implemented correctly/consistently, and to hand-check eyetracking data. I'm not the head of a lab so I don't share video (following my labs' practices), but if I was, I'd use Databrary to provide access to researchers who've been vetted by their institutions.
First names, because calling your participants "Hey You" is rude so it winds up on the video, and recording the name they're referred to in t