Anonymization of data involves taking steps to remove personal identifiers from a set of data. Once data is anonymized, it should be impossible — or at least very difficult — to figure out who the stored data is associated with. The term de-identification is often used synonymously with anonymization in this context.
Data is typically anonymized to protect the privacy of the subject. Anonymization may be applied to many data sets, including those used in medical studies and market research. Privacy laws — although they vary by jurisdiction — will often stipulate that any personal data tied to an individual cannot be used without their express consent. Once data is anonymized, those with access to it have free rein to use the information for various means without gaining express permission from the person (or people) involved.
Why Some Data Needs to Be Anonymized
In the age of the Internet of Things (IoT), there’s a plethora of data being collected about pretty much everyone, more so than ever before. What’s more, much of this data is digitized and stored online. Although much of it is not made public, select employees are trusted with access to their respective company’s data, and you also have the threat of hackers looking to steal data, often with malicious intent.
Virtually everything you do, both online and offline, can be tracked in the form of data, including doctor visits, interactions with companies in stores and online, browsing habits, app use, and more. If you’re a gadget fanatic and live in a smart home, then everyday things like how you take your coffee and the temperature at which you wash your clothes may be recorded, too.
While much of the data collected is aggregated and not tied to an individual, privacy problems arise when information is tied to Personally Identifiable Information (PII). This includes thing like email, name, IP address, and location. Although, it’s worth noting that the definition of PII can vary by country and company.
User Options for Data Protection
When it comes to online activities, users have options to ensure they maintain their privacy, such as using a Virtual Private Network (VPN) to encrypt their internet traffic. This way, ISPs and other companies, agencies, or hackers can’t collect their data, and users can browse, torrent, and use other internet-connected applications privately and securely.
However, most people don’t take these precautions, and even those who do can’t get away from giving up at least some personal information, such as medical information during a hospital visit. Their privacy protection is then in the hands of whoever is collecting the data.
Data de-identification is a means to protect their privacy by separating any PII from other details. This is especially important given the number and severity of data breaches that occur across a range of industries.
In some cases, organizations are mandated by laws or regulations to anonymize data. Or anonymization may be suggested, and companies choose to err on the side of caution. In other cases, anonymization may be used to promote the use of a service or help encourage people to hand over their information in the first place.
GDPR and Other Privacy Laws
In May 2018, the EU introduced the General Data Protection Regulation (GDPR) legislation, which is intended to greatly enhance the privacy rights of its citizens. Some of the major areas that this regulation focuses on are the prompt reporting of data breaches, enhanced consumer rights in relation to the consent of data collection and access to stored data, and stricter regulations for companies with respect to securing consumer data.
Data anonymization or at least pseudonymization (see below) is highly recommended in the GDPR. Note that the GDPR expands the scope of what is considered PII, and includes IP addresses and e-signatures on top of the obvious name, address, and phone number. Additionally, the GDPR applies to any company dealing with the data of EU citizens, residents, or businesses, not just companies situated in the EU.
Other privacy regulations that can be measured up against the GDPR are Canada’s Personal Information Protection and Electronic Documents Act and Australia’s Privacy Act. The US doesn’t have a comparable federal privacy law, although there is the California Consumer Privacy Act, a state law that is similar to the GDPR. There are also some specific laws in place to protect the privacy of US citizens and residents. One note is the Health Insurance Portability and Accountability Act (HIPAA), which is limited to medical information.
How Data is Anonymized
There are various methods by which data can be de-identified, although many don’t offer true anonymization. Here are some common strategies:
-
Suppression: This is simply the complete removal of select data points.
-
Randomization: Randomization might involve noise addition (expressing personal identifiers imprecisely) or substitution (replacing identifiers with random values).
-
Generalization: This involves grouping data, for example, using age ranges instead of specific ages or only using the area codes of phone numbers.
-
Perturbation: Data points are changed slightly (this is only acceptable if accurate data is not required).
-
Aggregation: Data is stored in aggregate for summarization. For example, ages might not be recorded for individuals, but the total number of subjects of a given age is known. When companies sell personal data, this is often the form it comes in.
-
Encryption: This doesn’t remove the identifying data but encrypting it makes it unreadable to anyone without the decryption key.
-
Hashing: Like encryption, hashing doesn’t remove data points, but rather replaces them with a hash (an alphanumeric string).
-
Pseudonymization: This substitutes the identifying data with a placeholder — sometimes using encryption or hashing — but the subject can be re-identified with the right information.
The chosen method of data anonymization will depend on various factors, including regional laws, industry regulations, the nature of the information, and its intended use. Companies often employ the use of data anonymization software, such as Oracle Advanced Security and IBM Security Guardium.
An example of relatively simple anonymization is the IP anonymization tool built into Google Analytics. By switching this on, site administrators who deploy Google Analytics software can be assured they’re not breaching privacy laws by collecting PII.
De-Anonymization
Just because data is anonymized doesn’t mean it’s always impossible to discover the identity of the subject. Many of the anonymization techniques above can be reversible. For example, hashed data could be de-anonymized by guessing the data until a matching hash was found. Even using irreversible suppression, probably the most failsafe method of anonymization, the remaining data could be cross-referenced with other data sets to identify the source. This is referred to as de-anonymization. Of course, the additional data would have to include PII for the de-anonymization to be successful.
Encrypted data could theoretically be de-anonymized too, but given the strength of encryption available these days — with some protocols considered uncrackable — you’d probably need the decryption key to access the data.