Anonymization

The defining characteristic of anonymization is the permanent destruction of the link between the data and the individual. Once data is truly anonymized, the process cannot be undone, and the data subject cannot be re-identified, even by the data controller. This distinguishes it from pseudonymization, where the link is merely suppressed and can be restored with a key. True anonymization places the data outside the scope of data protection regulations like GDPR.

Modern anonymization is a risk-based concept, not an absolute state. It relies on the principle that re-identification must be impossible under 'reasonably likely' means.

• Absolute Anonymization: A theoretical ideal where no information about an individual remains distinguishable.
• Statistical Anonymization: The practical standard, where the risk of re-identification is reduced to a sufficiently small, acceptable threshold using techniques like k-anonymity or differential privacy.

Regulators assess the cost, time, and technical expertise required for an attacker to re-identify the data.

Achieving anonymization requires a combination of technical safeguards:

• Generalization: Reducing the granularity of data, such as replacing exact ages with age ranges (e.g., 35 → 30-40).
• Suppression: Removing entire records or specific attribute values that are too unique.
• Perturbation: Adding calibrated noise to numerical data to mask exact values while preserving statistical distributions.
• Data Swapping: Exchanging values of sensitive attributes between records to break the link between individuals and their data.
• Aggregation: Reporting only summary statistics (e.g., averages, counts) rather than individual-level records.

Before releasing an anonymized dataset, a formal re-identification risk assessment is mandatory. This evaluates:

• Singling Out: Can an individual's record be isolated within the dataset?
• Linkability: Can records about the same individual be linked across two different datasets?
• Inference: Can sensitive attributes be deduced with high probability from other attributes?

A common metric is k-anonymity, which ensures each record is indistinguishable from at least k-1 other records. A dataset with k=5 means any individual's data is hidden within a group of at least 5 similar records.

These terms are often conflated but have critical legal distinctions:

• De-identification is a process that removes direct and indirect identifiers under a specific regulatory framework, such as the HIPAA Safe Harbor method (removing 18 identifiers). It is a procedural act.
• Anonymization is the resulting state of the data—the irreversible outcome where re-identification is no longer possible.

De-identified data under HIPAA may still carry a small residual risk of re-identification through linkage attacks using quasi-identifiers (e.g., ZIP code, birth date, gender). True anonymization requires mitigating this residual risk.

A linkage attack is the primary threat to anonymized datasets. An attacker cross-references the released data with an external, publicly available dataset to re-identify individuals.

Example: A medical dataset releases anonymized records containing quasi-identifiers like ZIP code, gender, and date of birth. An attacker links this to a public voter registration database containing names, ZIP codes, genders, and dates of birth, successfully re-identifying individuals.

This was infamously demonstrated when researchers re-identified the governor of Massachusetts in a supposedly anonymized state health insurance dataset by linking it to the Cambridge voter roll.

A reversible data protection technique that replaces direct identifiers (e.g., name, MRN) with artificial pseudonyms. Unlike anonymization, the mapping is preserved, allowing re-linking under controlled conditions. This is distinct from anonymization, which severs the link permanently. Pseudonymization is often used in clinical research where longitudinal tracking is required but direct identity must be hidden from analysts.

A privacy model ensuring an individual's released data cannot be distinguished from at least k-1 other individuals in the dataset. Key concepts include:

• Quasi-identifiers: Attributes like ZIP code, age, and sex that can link records
• Equivalence classes: Groups of records sharing the same quasi-identifier values
• Suppression & generalization: Techniques to achieve k-anonymity by coarsening data k-anonymity protects against identity disclosure but remains vulnerable to homogeneity attacks.

A mathematical framework providing a provable guarantee that the output of a query is statistically indistinguishable whether any single individual is included or excluded from the dataset. Achieved by injecting calibrated noise (typically Laplace or Gaussian) into query results. The privacy budget parameter epsilon (ε) quantifies the privacy loss—lower values mean stronger privacy. This is the gold standard for preventing re-identification in aggregate data releases.

The statistical probability that an attacker can correctly link de-identified records back to specific individuals using auxiliary information. Key attack vectors include:

• Linkage attacks: Cross-referencing with public datasets (voter rolls, census data)
• Prosecutor risk: The risk for a specific targeted individual
• Journalist risk: The risk that any individual in the dataset can be re-identified Anonymization requires this risk to be reduced to zero under any reasonably likely means.

A prescriptive de-identification method requiring the removal of 18 specific identifiers from protected health information. These include:

• Names, geographic subdivisions smaller than a state
• All date elements (except year) related to an individual
• Telephone numbers, fax numbers, email addresses
• Social security numbers, medical record numbers, health plan beneficiary numbers
• Full-face photographs and biometric identifiers Once all 18 are removed with no actual knowledge of re-identification risk, the data is considered anonymized under HIPAA.

A privacy attack where an adversary cross-references a de-identified dataset with publicly available external datasets to re-identify individuals. The classic example is the Sweeney attack, where the Governor of Massachusetts's medical records were re-identified by linking a de-identified hospital discharge dataset with the Cambridge voter registration list using ZIP code, birth date, and sex. This demonstrates why removing direct identifiers alone is insufficient for true anonymization.