Anonymization and Re-identification Risk

Anonymization and Re-identification Risk (CDPSE Privacy Engineering)

Introduction
Anonymization and re-identification risk is a core topic in the CDPSE (Certified Data Privacy Solutions Engineer) Privacy Engineering domain. It covers how organizations change personal data so that individuals can no longer be identified, and how they measure and manage the risk that someone could reverse that protection. A privacy engineer must know the techniques, their limits, the regulations behind them and the governance that keeps protection effective over time.

Why It Is Important
1. Regulatory scope: Under GDPR (Recital 26), truly anonymous data is no longer personal data and falls outside the regulation. Pseudonymized data is still personal data. Getting this distinction wrong can create serious non-compliance.

2. Enabling data use: Anonymization lets organizations use data for analytics, research, AI/ML training, testing and sharing with partners while respecting data minimization and purpose limitation.

3. Reducing breach impact: Properly de-identified data lowers harm to individuals if it is exposed. It can also reduce notification obligations.

4. Real-world failures: Several well-known cases show that removing names is not enough:
- AOL search logs (2006): users were identified from their search queries.
- Netflix Prize dataset: ratings were linked to public IMDb reviews.
- Massachusetts health records (Latanya Sweeney): the Governor was re-identified.
- Sweeney's research found that about 87% of the US population can be uniquely identified by ZIP code, gender and date of birth.

5. Trust and ethics: Re-identification damages customer trust and can lead to discrimination, reputational harm and regulatory fines.

What It Is: Key Definitions
Anonymization: An irreversible process that changes personal data so the data subject can no longer be identified, directly or indirectly. This must hold against all means reasonably likely to be used, by the controller or any third party.

Pseudonymization: Direct identifiers are replaced with pseudonyms, such as tokens or keyed hashes. The data can be re-linked using additional information (the key or mapping table), which must be kept separately and protected. It is reversible, so the data remains personal data.

De-identification: A broad term, often used in US contexts such as HIPAA, for removing or obscuring identifiers. Depending on how it is done, the result may or may not be truly anonymous.

Types of data attributes:
- Direct identifiers: name, SSN, email, phone number, account number.
- Quasi-identifiers (indirect identifiers): ZIP code, date of birth, gender, job title, ethnicity. These can identify a person when combined.
- Sensitive attributes: diagnosis, salary, religion. These are the values an attacker wants to learn.
- Non-identifying attributes: everything else.

Re-identification risk: The probability that an individual in a de-identified dataset can be identified or have information about them revealed.

How It Works: Anonymization and De-identification Techniques
1. Suppression / redaction: Removing entire attributes or records, such as outliers or rare values.

2. Generalization: Making values less precise. Examples: age 34 becomes 30-39, a full ZIP code becomes its first 3 digits, a date becomes a year.

3. Masking: Hiding part of a value, for example showing a card number as XXXX-XXXX-XXXX-1234.

4. Perturbation / noise addition: Slightly changing values while keeping statistical properties.

5. Data swapping / permutation: Exchanging attribute values between records.

6. Aggregation: Releasing only summary statistics, often with minimum cell-size thresholds such as no cells under 5 or 10.

7. Tokenization and hashing: Common pseudonymization methods.
- Unsalted hashes of low-entropy values such as phone numbers or SSNs can be reversed by brute force or dictionary attacks.
- Keyed hashing (HMAC) or vaulted tokenization is stronger.
- These methods are still pseudonymization, not anonymization.

8. Synthetic data: Artificially generated data that mimics the statistical patterns of real data. If the generating model overfits, records can still be memorized and leaked.

9. Differential privacy: A mathematical guarantee that adding or removing any one individual barely affects query outputs.
- It works by adding calibrated noise, controlled by a privacy budget called epsilon.
- Smaller epsilon means stronger privacy but lower utility.
- It is used by the US Census Bureau, Apple and Google.

Privacy Models (Formal Measures)
k-anonymity: Each record cannot be distinguished from at least k-1 others on its quasi-identifiers. Each group of records sharing the same quasi-identifier values is called an equivalence class.
- Weakness to the homogeneity attack: everyone in a class has the same sensitive value.
- Weakness to the background knowledge attack: an attacker uses outside facts to narrow down the target.

l-diversity: Each equivalence class contains at least l well-represented values of the sensitive attribute. This addresses homogeneity.
- Weakness to skewness and similarity attacks, where values differ but are semantically close.

t-closeness: The distribution of the sensitive attribute in each class stays within distance t of its distribution in the whole dataset.

Differential privacy: Protects against arbitrary background knowledge and gives a provable guarantee.

Re-identification Attacks and Risks
The three classic risks identified by the EU Article 29 Working Party (WP216, Opinion 05/2014) are:
- Singling out: isolating one individual's records.
- Linkability: linking records about the same person across datasets.
- Inference: deducing the value of an attribute with significant probability.

Other attack vectors:
- Linkage attacks: joining the dataset with public or auxiliary data such as voter rolls or social media.
- Mosaic effect: combining several harmless releases to reveal identity.
- Outliers and small populations: rare combinations, such as a 98-year-old in a small town, are easy to identify.
- Longitudinal and location data: movement traces are highly unique. Research shows about 4 spatio-temporal points can identify 95% of people.
- Weak pseudonymization: unsalted hashes, or keys stored next to the data.
- Model inversion and membership inference: attacks on ML models trained on personal data.

Re-identification Risk Assessment Process
1. Define the purpose and release context: public release, limited sharing under contract, or internal use. Public release carries the highest risk.
2. Classify attributes: direct identifiers, quasi-identifiers and sensitive attributes.
3. Model the threat: who might attack (prosecutor, journalist or marketer models), their motives, capabilities and available auxiliary data.
4. Measure risk: uniqueness, equivalence class sizes, maximum and average risk, and thresholds such as 0.09 or 0.05 depending on context.
5. Apply techniques: transform the data until risk falls below the threshold while keeping acceptable utility.
6. Validate: run motivated intruder tests and expert determination.
7. Apply contextual controls: data sharing agreements that prohibit re-identification, access controls, audit logging, secure enclaves and the 'Five Safes' framework (safe projects, people, settings, data and outputs).
8. Document, monitor and reassess: risk changes as new datasets and technologies appear, so anonymization is not a one-time event.

Regulatory Reference Points
GDPR: Recital 26 (anonymous data is out of scope), Article 4(5) (pseudonymization), and Articles 25 and 32 (pseudonymization as a privacy-by-design and security measure).

HIPAA de-identification:
- Safe Harbor: remove 18 specified identifiers and have no actual knowledge that the remaining data could identify someone.
- Expert Determination: a qualified expert certifies that the risk is very small.

CCPA/CPRA: Deidentified data requires technical measures, a public commitment not to re-identify, and contractual obligations on recipients.

Standards and guidance: ISO/IEC 20889 (de-identification techniques), ISO/IEC 27559 (de-identification framework), NIST SP 800-188, the UK ICO anonymisation guidance and the EDPB/WP29 Opinion 05/2014.

Privacy-Utility Trade-off
Stronger anonymization usually reduces data usefulness. The privacy engineer's job is to find the balance that meets the business purpose while keeping re-identification risk acceptable. Practical guidance:
- Start with data minimization: do not collect or share what is not needed.
- Prefer aggregated outputs where possible.
- Match the technique to the use case. For example, use pseudonymization for internal analytics that needs linkage over time, and differential privacy for public statistics.

Exam Tips: Answering Questions on Anonymization and Re-identification Risk
1. Know anonymization vs. pseudonymization cold.
- If data can be re-linked using a key, token vault or mapping table, it is pseudonymized and still personal data.
- Answers claiming that tokenized or hashed data is 'anonymous' and outside regulatory scope are usually wrong.

2. Removing direct identifiers is never enough. When a scenario says names and SSNs were removed, look for the answer that addresses quasi-identifiers and linkage risk.

3. Assess risk first, then choose a technique. ISACA favors a risk-based, process-driven approach. When asked what to do FIRST, choose options such as:
- identifying the data and its purpose,
- classifying attributes, or
- performing a re-identification risk assessment.
Choose these over jumping straight to a specific tool.

4. Context matters. The same dataset carries different risk for public release than for a controlled environment with contracts. Combine technical controls with administrative and contractual ones. 'Combination of controls' answers are often best.

5. Anonymization is ongoing. Answers that mention periodic reassessment, monitoring of new auxiliary data, or re-evaluation before each new release are favored.

6. Match the attack to the model.
- k-anonymity is weak against homogeneity and background knowledge attacks; l-diversity fixes homogeneity.
- t-closeness fixes skewness and similarity attacks.
- Differential privacy resists background knowledge and gives mathematical guarantees.

7. Watch for hashing traps. Unsalted hashes of low-entropy identifiers are reversible by dictionary attack. The better answer is a keyed hash, salt or tokenization with key separation, while still treating the result as personal data.

8. Protect the re-identification key. For pseudonymization, the key or mapping must be stored separately, access-controlled and logged. Segregation of duties is a common correct answer.

9. Remember the three WP29 risks. Singling out, linkability and inference are a frequent basis for evaluating whether a technique truly anonymizes.

10. Consider the privacy-utility balance. If a question asks for the BEST approach for analytics, pick the option that meets the business need with the least identifiable data. That is not always maximum suppression.

11. Small numbers and outliers are red flags. Rare records, small geographic areas and small cell counts increase risk. Generalization, suppression or minimum thresholds are the fix.

12. Read qualifiers carefully. Words such as BEST, MOST, FIRST, PRIMARY and GREATEST risk matter.
- The greatest risk to a de-identified dataset is usually linkage with external data.
- The primary purpose of anonymization is to prevent identification of data subjects while enabling data use.

13. Contracts support but do not replace technical measures. Data sharing agreements that prohibit re-identification are valuable. In ISACA's view, though, they complement technical de-identification rather than replace it.

14. ML and synthetic data are not automatically safe. Expect questions noting that trained models or synthetic datasets can leak training data. Mitigations include differential privacy in training, overfitting checks and membership inference testing.

Quick Memory Aid
'CLASSIFY - ASSESS - TRANSFORM - CONTROL - MONITOR'
- Classify identifiers.
- Assess re-identification risk in context.
- Transform with suitable techniques.
- Control access and use contractually and technically.
- Monitor and reassess continuously.

Summary
Anonymization lets organizations get value from data while protecting individuals. It is hard to achieve, though, and re-identification risk never truly reaches zero. CDPSE candidates should show they understand:
- the legal difference between anonymous and pseudonymous data,
- the strengths and weaknesses of each technique and privacy model,
- the attack vectors that undermine de-identification, and
- a risk-based, layered and continuously monitored approach to managing the residual risk.