Participant identifier for a field study in a sensitive work environment We are doing an evaluation in different organizations and need to get data from workers about their work behavior. As this information is something that could get workers in trouble, privacy is an issue, so we go for anonymized questionnaires. To connect the data over time, we are looking for a participant identifier. Based on prior experiences, asking for:

Kindly write down your participant code. This code consists of the first letter of your place of birth, the first letter of your own first name, the first letter of the first name of your mother, and your own day of birth.

has the disadvantage that some participants think that their colleagues or superiors can guess the code and there are always a few participants who do not know one parent. Also, participants make mistakes with this code.
So my question is -- is there a way to ask for a code that allows us to connect data over time (i.e., it is unique for a person), yet is also accepted by participants?
Update: I had a look at the answers here (thank you very much) -- one caveat, we are organizing the evaluation, but there are different researchers (separate institutions) visiting the sites. Meaning that keeping a list of the participants real names and their codes does not work (if one institution kept it, it would create a bottleneck). Ideally the code is something that is solely on the participants side.
 A: I think what most people do is to keep the participant ID and their real identity in a separate secure location. You access it only to contact them, reminding them of their ID right before the next round of surveys. 
When you are dealing with the data, you only get to see their ID and their responses for the surveys; but all sensitive personal information are locked up.
A: In addition to King's answer that the research organization should retain the IDs but keep them separate from the real identities, there are other measures you should put in place to protect the anonymity of the findings in a situation like this:


*

*the client should never have access to the raw data, so even if they could connect the ID to the real identity, they couldn't connect it to the survey findings

*you need to have clear policies when you can report what level of detail about the data. For example, quantitative data shall not be reported on groups of less than 5; open-ended response comments will not be reported on groups of less than 25, etc.

*identifying information disclosed in reports should be kept to a minimum. For example, things like work department, job title groups, etc. should only be included where it is relevant for the purpose at hand.

A: Interesting question.  Your approach seems feasible, if you can think of even less commonly known pieces of information.  Perhaps some of these might work for you:
Number of bank accounts you have. If more than 9, enter 9.
First letter of the last name of your first dentist.  If unknown, enter A.
How many close friends did you have when you were 21. If more than 9, enter 9.
First letter of your favorite teacher's last name.
First letter of your maternal grandmother's maiden name. If unknown, enter A.
First letter of your paternal grandmother's maiden name. If unknown, enter A.
First letter of city/town where your father was born.  If unknown, enter A.
First letter of city/town where your mother was born.  If unknown, enter A.
First letter of city/town where your oldest aunt or uncle was born. If unknown, enter A.
Number of siblings of your paternal grandfather. If unknown enter 1.
Number of siblings of your maternal grandfather. If unknown enter 1.
etc.
Probably some pilot work is in order, to see if your respondents like the questions you use and think they will work.  Perhaps you know the names of the respondents who were not happy with your previous coding system and can ask them.
