Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Algorithm can pick out almost any American in supposedly anonymized databases

nytimes.com

Post reply on HN
Print view View original

71–80 of 101 posts

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#71

Post by jklehm »

rzwitserloot wrote: post #10

I'm a programmer in the GP data analysis world. We use the term 'pseudonymization' for this kind of data. 'Anonymization' is used solely to refer to, say, 'the sum total of diabetes patients this practice has' (that would be anonymous patient data; it would not be anonymous relative to the GP office this refers to): Aggregated data that can no longer be reduced to a single individual at all. The term raises questions…

As far as health data is concerned the regulation is very clear that any aggregates must have a certain minimum amount in bin for precisely this reason.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#72

Post by Zenst »

shusson wrote: post #65
Shaanie wrote: post #61

Earlier quoted context omitted.

That seems correct. From an article on the subject: >Recital 26 of the GDPR defines anonymized data as “data rendered anonymous in such a way that the data subject is not or no longer identifiable.” Although circular, this definition emphasizes that anonymized data must be stripped of any identifiable information, making it impossible to derive insights on a discreet individual, even by the party that is responsible…

it is not clear to me if this covers re-identifying.

I'd say that is pretty clear-cut with "making it impossible to derive insights on a discreet individual"

If it is possible, it's not anonymous per GDPR's definition and that is what counts.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#73

Post by [deleted] »

hiccuphippo wrote: post #67
gervu wrote: post #24

Earlier quoted context omitted.

Pseudonymization already refers to reference by pseudonym. Pseudonimization is bad terminology in that it's indistinct from the above, to the point that parent has already mixed the two up while in the process of recommending it. And it'd be worse verbally. "Pseudo-anonymization" could work, but something like "breakable anonymization" or "partial anonymization" might be better in that it's more obvious to a reader a…

ESL here, what's wrong with pseudonymization as a derivative of pseudonym? I think it brings the point across. But if we want to stop beating around the bush, what about "nameless identification"?

[deleted]

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#74

Post by WhitneyLand »

hiccuphippo wrote: post #67
gervu wrote: post #24

Earlier quoted context omitted.

Pseudonymization already refers to reference by pseudonym. Pseudonimization is bad terminology in that it's indistinct from the above, to the point that parent has already mixed the two up while in the process of recommending it. And it'd be worse verbally. "Pseudo-anonymization" could work, but something like "breakable anonymization" or "partial anonymization" might be better in that it's more obvious to a reader a…

ESL here, what's wrong with pseudonymization as a derivative of pseudonym? I think it brings the point across. But if we want to stop beating around the bush, what about "nameless identification"?

>if we want to stop beating around the bush, what about "nameless identification"?

The difference is the other proposed alternatives more directly suggest risk is involved.

It's a nice ESL example because technically, I don't think you're suggestion is wrong. In practice I think few would infer its implications.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#75

Post by leetcrew »

BerislavLopac wrote: post #32
cheez wrote: post #14

Earlier quoted context omitted.

It doesn't roll off the tongue, perhaps pseudo-anonymization is enough.

I would suggest "denonymization", implying that the "names" (i.e. identifiable information) were removed. As opposed to a nonymous data, which presumably never had any to start with, like the example mentioned by the GP.

from an etymological perspective, this is kind of gross; you are grafting a latin-derived prefix onto a greek-derived stem. there's no direct Greek equivalent to the Latin "de", but you could consider "apo" or possibly "kata", both of which have similar meanings.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#76

Post by lmkg »

rzwitserloot wrote: post #10

I'm a programmer in the GP data analysis world. We use the term 'pseudonymization' for this kind of data. 'Anonymization' is used solely to refer to, say, 'the sum total of diabetes patients this practice has' (that would be anonymous patient data; it would not be anonymous relative to the GP office this refers to): Aggregated data that can no longer be reduced to a single individual at all. The term raises questions…

  > My go-to example to explain this is very simple: Let's 
  > say we reduce birthdate info to just your birthyear, 
  > and geoloc info to just a wide area. And then I have 
  > an pseudonimized individual who is marked down as 
  > being 105 years old.

  > Usually there's only one such person.
I was interested to find that HIPAA's requirements for de-identification address the two particular issues you pointed out. First, age above some threshold (90) must be bucketed together as "older than 90." Second, regarding ZIP codes: you must zero out the last two digits. And then, if the resulting identifier contains less than 20,000 inhabitants according to the most recent US census, you have to blank the first three digits as well (there are currently 17 such three-digit prefixes).

Source: Pages 96-97 of the combined legislation, available at: https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg...

You are allowed to roll your own de-identification method, as long as the person doing so is an expert on statistics and de-identification and they document their analysis of why their method is sound. To my knowledge, most entities use the "safe harbor" approach of wiping any data in the legislated blacklist of dimensions.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#77

Post by [deleted] »

GhostVII wrote: post #35
tialaramex wrote: post #5

If people tell you they're collecting data for statistical purposes, then one of three things: 1. They should deliberately introduce noise into the raw data. Nazis with the raw census data can spend all month trying to find the two 40-something Jews that data says live on this island of 8400 people, but they were just noise. Or were they? No way to know. 2. Bucket everything and discard all raw data immediately. This…

> They shouldn't collect _anything_ personally identifiable Why not just ensure that any personally identifiable data is properly bucketed, and discarded if it is too strongly identifiable. If you are storing someone's height, age, and gender, you can just increase the bucket size for those fields until every combination of identifiable fields occurs several times in the dataset. If there are always a few different r…

[deleted]

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#78

Post by shusson »

Zenst wrote: post #72
shusson wrote: post #65

Earlier quoted context omitted.

it is not clear to me if this covers re-identifying.

I'd say that is pretty clear-cut with "making it impossible to derive insights on a discreet individual" If it is possible, it's not anonymous per GDPR's definition and that is what counts.

> "making it impossible to derive insights on a discreet individual"

doesn't clarify how much information you already have about the individual. There is a distinction between being able to identify someone without any prior knowledge about them vs re-identifying them. I don't think the GDPR is clear about that.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#79

Post by mnky9800n »

Cynddl wrote: post #55
Freak_NL wrote: post #18

Earlier quoted context omitted.

What accounts for that remaining 2‰ of uncertainty?

Co-author here. We designed a statistical model, which is never 100% sure a re-identification is correct. There is, e.g., a non-null probability that two individuals in the US share 5, 10, or even 15 demographics attribute.

Can you provide a link to your paper?

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#80

Post by jobigoud »

BerislavLopac wrote: post #32
cheez wrote: post #14

Earlier quoted context omitted.

It doesn't roll off the tongue, perhaps pseudo-anonymization is enough.

I would suggest "denonymization", implying that the "names" (i.e. identifiable information) were removed. As opposed to a nonymous data, which presumably never had any to start with, like the example mentioned by the GP.

> I would suggest "denonymization"

Very very close to the existing "deanonymization" which is essentially the opposite.

Post reply on HN