De-identification

A critical distinction exists between anonymization and pseudonymization. True anonymization renders re-identification impossible by permanently destroying the mapping between identifiers and subjects. Pseudonymization replaces direct identifiers with artificial pseudonyms, retaining a controlled pathway for re-linking data under strict security conditions. Under GDPR, pseudonymized data remains personal data, while properly anonymized data falls outside regulatory scope.

Ad-hoc removal of identifiers is insufficient. Defensible de-identification relies on formal mathematical models:

• k-Anonymity: Ensures each record is indistinguishable from at least k-1 other records, preventing singling out individuals.
• Differential Privacy: Injects calibrated statistical noise into query results, providing a provable guarantee that an adversary cannot determine whether any single individual's data was included in the dataset.
• l-Diversity and t-Closeness: Extensions of k-anonymity that protect against attribute disclosure when sensitive values within an equivalence class lack diversity or are skewed.

Direct identifiers like names and Social Security numbers are obvious targets. The real re-identification risk lies in quasi-identifiers—seemingly innocuous attributes like date of birth, ZIP code, and gender that, when combined, can uniquely identify a large percentage of the population. The landmark Sweeney study demonstrated that 87% of the U.S. population is uniquely identifiable using only {5-digit ZIP, gender, date of birth}. A rigorous de-identification pipeline must measure and mitigate the uniqueness of quasi-identifier combinations against external datasets.

A linkage attack occurs when an adversary cross-references a de-identified dataset with publicly available auxiliary datasets to re-identify individuals. The infamous Netflix Prize case saw researchers re-identify users by linking anonymized movie ratings with public IMDb reviews. Robust de-identification must assume the adversary possesses unlimited auxiliary information and apply transformations—such as generalization, suppression, and noise addition—that mathematically bound the probability of successful linkage.

Every de-identification transformation degrades data utility. The goal is to find the Pareto-optimal frontier where privacy risk is minimized while preserving analytical validity for the intended use case. Techniques like date shifting preserve temporal intervals for longitudinal studies, while generalization retains demographic distributions for epidemiological research. A qualified expert determination under HIPAA explicitly weighs this trade-off, documenting that the risk of re-identification is very small relative to the data's intended research or operational value.

De-identification is not purely a property of the data; it is a function of the data environment. The same dataset may be considered de-identified in a controlled research enclave with contractual access controls but re-identifiable if released publicly. The HIPAA Expert Determination method explicitly requires the statistician to consider the specific recipient, the terms of the data use agreement, and the existence of any known external datasets that could enable linkage. Contextual integrity demands ongoing vigilance, not a one-time transformation.

A data protection technique that replaces direct identifiers with artificial pseudonyms, allowing data to be re-linked under controlled conditions. Distinct from irreversible anonymization.

• Reversible: Requires a separately secured mapping table
• Longitudinal Integrity: Consistent pseudonym mapping ensures the same individual gets the same pseudonym across records
• GDPR Context: Explicitly defined and encouraged under GDPR as a technical safeguard

A mathematical framework providing a provable guarantee of privacy by injecting calibrated statistical noise into query results. The presence or absence of any single individual becomes indistinguishable.

• Epsilon (ε): The privacy loss parameter; lower values mean stronger privacy
• Mechanism: Typically uses Laplace or Gaussian noise injection
• Composability: Privacy loss accumulates across multiple queries, requiring careful budget management

A foundational privacy model ensuring that an individual's released data cannot be distinguished from at least k-1 other individuals in the same dataset. Prevents identity disclosure via quasi-identifiers.

• Quasi-Identifiers: Attributes like ZIP code, age, and gender that can link to external data
• Generalization: Achieved by coarsening data (e.g., reducing ZIP code to first 3 digits)
• Limitations: Vulnerable to homogeneity attacks if sensitive values within a group are identical

The specialized process of stripping PHI from the metadata headers and pixel data of medical images conforming to the Digital Imaging and Communications in Medicine standard.

• Header Sanitization: Removal of tags like PatientName (0010,0010) and PatientID (0010,0020)
• Burned-in PHI: Requires optical character recognition (OCR) to detect text rendered directly into image pixels
• Retaining Utility: Must preserve clinical parameters like acquisition settings while removing identifiers