Privacy-Preserving Record Linkage

A foundational PPRL technique that converts sensitive identity attributes into irreversible bit arrays. Each attribute string is hashed multiple times and the corresponding bits are set to 1 in a fixed-length binary vector. Similarity between two encoded records is computed using the Dice coefficient on their Bloom filters, enabling approximate matching without revealing the original plaintext. This method tolerates typographical errors and phonetic variations while maintaining cryptographic irreversibility.

SMPC allows multiple organizations to jointly compute a record linkage function over their combined datasets while keeping each party's input strictly private. The protocol distributes cryptographic shares of the data such that no single party can reconstruct the original records. Only the final match results are revealed. Common SMPC techniques include garbled circuits and secret sharing schemes, which provide provable security guarantees against semi-honest and malicious adversaries.

A cryptographic paradigm that enables computation directly on encrypted data without decryption. In PPRL, one party can encrypt their records and send them to a second party who performs the linkage algorithm on the ciphertexts. The result remains encrypted and can only be decrypted by the key holder. Fully Homomorphic Encryption supports arbitrary computations but incurs high computational overhead; practical PPRL implementations often use Partially Homomorphic Encryption schemes optimized for specific distance calculations.

PPRL protocols integrate phonetic algorithms like Soundex, Double Metaphone, and NYSIIS to normalize names before cryptographic encoding. These algorithms convert names into codes representing their pronunciation, ensuring that homophones such as 'Jon' and 'John' produce identical encodings. This preprocessing step dramatically improves match rates for names with spelling variations, which is critical for financial institutions linking customer records across systems with inconsistent data entry standards.

Naive record linkage requires comparing every record pair across datasets, which is computationally infeasible at scale. PPRL protocols employ blocking keys derived from encoded attributes to partition records into mutually exclusive blocks. Only records within the same block are compared, reducing the quadratic complexity to near-linear. Privacy-preserving blocking ensures that the blocking key itself does not leak sensitive information about the underlying records.

Advanced PPRL protocols incorporate differential privacy mechanisms to protect against inference attacks on the linkage output. By injecting calibrated statistical noise into the match results, an adversary cannot determine with certainty whether any specific individual's record was present in the source datasets. The privacy budget parameter epsilon controls the trade-off between linkage accuracy and the formal privacy guarantee, satisfying the mathematical definition of differential privacy.

A space-efficient probabilistic data structure that converts sensitive identity attributes—such as names or dates of birth—into irreversible bit arrays. Multiple attributes are hashed into a single Bloom filter using multiple hash functions, enabling approximate matching via set overlap metrics like Dice coefficient. Crucially, the original plaintext cannot be reconstructed from the bit array, making it a cornerstone of privacy-preserving record linkage. Collisions are intentionally introduced to provide plausible deniability against brute-force attacks.

An encryption scheme that permits computation directly on ciphertexts, generating an encrypted result that, when decrypted, matches the output of operations performed on the plaintext. Applied to record linkage, partially homomorphic encryption allows similarity calculations on encrypted identifiers without ever decrypting them. The data custodian never sees the querying party's records, and the querying party never accesses the raw database. Performance overhead remains a practical constraint for large-scale linkage.

A cryptographic protocol where two parties each hold a set of elements and wish to compute the intersection without revealing any elements outside that intersection. Applied to identity matching, PSI allows organizations to discover common customers across databases without exposing their full customer lists. Variants include server-aided PSI for multi-party scenarios and fuzzy PSI for approximate matching. This technique is foundational for privacy-compliant data collaboration.

A privacy engineering approach where a trusted third party replaces PII with irreversible, cryptographically generated tokens before data is shared for linkage. The tokenization service applies consistent hashing with a secret salt, ensuring the same input always produces the same token across datasets. This enables deterministic matching without exposing raw identifiers. The security model depends entirely on the trustworthiness and compromise resistance of the tokenization service.