Another option is to generate a token that the user can save and re-enter when they take the survey again the next year. Then the data could be tagged with a hash of the token.

You'd get some misplaced tokens, but it should be pretty safe, privacy-wise. I think the biggest concern would be that linked results could narrow down the possibilities for someone's real-life identity, especially if they had a significant change of demographic status such as moving from one place to another or getting married.