It's unclear why they didn't get the UK Data Service to handle this, who have extensive experience in anonymization and data control (they handle the processing of census data and HMRC tax information by external researchers among other things).
The data gets held in N3 which is an entirely separate system/network, and has a much higher set of standards than UKDS would largely be used to using. HSCIC are well used to doing this as well.
It may be that the Guardian is misreporting it, but from their description the data level is far less anonymized than what I've seen when working with UKDS data.
