De-identification
De-identification is the process used to prevent someone's personal identity from being revealed. For example, data produced during human subject research might be de-identified to preserve the privacy of research participants. Biological data may be de-identified in order to comply with HIPAA regulations that define and stipulate patient privacy laws. [1]
When applied to metadata or general data about identification, the process is also known as data anonymization. Common strategies include deleting or masking personal identifiers, such as personal name, and suppressing or generalizing quasi-identifiers, such as date of birth. The reverse process of using de-identified data to identify individuals is known as data re-identification. Successful re-identifications[2][3][4][5] cast doubt on de-identification's effectiveness. A systematic review of fourteen distinct re-identification attacks found "a high re-identification rate […] dominated by small-scale studies on data that was not de-identified according to existing standards".[6]
De-identification is adopted as one of the main approaches toward data
Examples
In designing surveys
When surveys are conducted, such as a census, they collect information about a specific group of people. To encourage participation and to protect the privacy of survey respondents, the researchers attempt to design the survey in a way that when people participate in a survey, it will not be possible to match any participant's individual response(s) with any data published.[9]
Before using information
When an online shopping website wants to know its users' preferences and shopping habits, it decides to retrieve customers' data from its database and do analysis on them. The personal data information include personal identifiers which were collected directly when customers created their accounts. The website needs to pre-handle the data through de-identification techniques before analyzing data records to avoid violating their customers' privacy.
Anonymization
Anonymization refers to irreversibly severing a data set from the identity of the data contributor in a study to prevent any future re-identification, even by the study organizers under any condition.[10][11] De-identification may also include preserving identifying information which can only be re-linked by a trusted party in certain situations.[10][11][12] There is a debate in the technology community on whether data that can be re-linked, even by a trusted party, should ever be considered de-identified.[13]
Techniques
Common strategies of de-identification are masking personal identifiers and generalizing quasi-identifiers. Pseudonymization is the main technique used to mask personal identifiers from data records, and k-anonymization is usually adopted for generalizing quasi-identifiers.
Pseudonymization
Pseudonymization is performed by replacing real names with a temporary ID. It deletes or masks personal identifiers to make individuals unidentified. This method makes it possible to track the individual's record over time, even though the record will be updated. However, it can not prevent the individual from being identified if some specific combinations of attributes in the data record indirectly identify the individual.[14]
k-anonymization
k-anonymization defines attributes that indirectly points to the individual's identity as quasi-identifiers (QIs) and deal with data by making at least k individuals have some combination of QI values.[14] QI values are handled following specific standards. For example, the k-anonymization replaces some original data in the records with new range values and keep some values unchanged. New combination of QI values prevents the individual from being identified and also avoid destroying data records.
Applications
Research into de-identification is driven mostly for protecting
In
In
Limits
Whenever a person participates in genetics research, the donation of a biological specimen often results in the creation of a large amount of personalized data. Such data is uniquely difficult to de-identify.[17]
Anonymization of genetic data is particularly difficult because of the huge amount of genotypic information in biospecimens,[17] the ties that specimens often have to medical history,[18] and the advent of modern bioinformatics tools for data mining.[18] There have been demonstrations that data for individuals in aggregate collections of genotypic data sets can be tied to the identities of the specimen donors.[19]
Some researchers have suggested that it is not reasonable to ever promise participants in genetics research that they can retain their anonymity, but instead, such participants should be taught the limits of using coded identifiers in a de-identification process.[11]
De-identification laws in the United States of America
In May 2014, the
The HIPAA Privacy Rule provides mechanisms for using and disclosing health data responsibly without the need for patient consent. These mechanisms center on two HIPAA de-identification standards – Safe Harbor and the Expert Determination Method. Safe harbor relies on the removal of specific patient identifiers (e.g. name, phone number, email address, etc.), while the Expert Determination Method requires knowledge and experience with generally accepted statistical and scientific principles and methods to render information not individually identifiable.[21]
Safe harbor
The safe harbor method uses a list approach to de-identification and has two requirements:
- The removal or generalization of 18 elements from the data.
- That the Covered Entity or Business Associate does not have actual knowledge that the residual information in the data could be used alone, or in combination with other information, to identify an individual. Safe Harbor is a highly prescriptive approach to de-identification. Under this method, all dates must be generalized to year and zip codes reduced to three digits. The same approach is used on the data regardless of the context. Even if the information is to be shared with a trusted researcher who wishes to analyze the data for seasonal variations in acute respiratory cases and, thus, requires the month of hospital admission, this information cannot be provided; only the year of admission would be retained.
Expert Determination
Expert Determination takes a risk-based approach to de-identification that applies current standards and best practices from the research to determine the
- That the risk is very small that the information could be used alone, or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information;
- Documents the methods and results of the analysis that justify such a determination.
Research on decedents
The key law about research in
See also
References
- ^ Rights (OCR), Office for Civil (2012-09-07). "Methods for De-identification of PHI". HHS.gov. Retrieved 2020-11-08.
- ^ Sweeney, L. (2000). "Simple Demographics Often Identify People Uniquely". Data Privacy Working Paper. 3.
- PMID 23524645.
- PMID 25635097.
- arXiv:cs/0610105.
- PMID 22164229.
- OCLC 933741839.
- ^ hdl:2299/19652.
- ^ Bhaskaran, Vivek (2023-06-08). "Survey Research: Definition, Examples and Methods". QuestionPro. Retrieved 2023-12-17.
- ^ PMID 14718939.
- ^ PMID 20371468.
- PMID 17460129.
- ^ "Data de-identification". The Abdul Latif Jameel Poverty Action Lab (J-PAL). Retrieved 2023-12-17.
- ^ a b Ito, Koichi; Kogure, Jun; Shimoyama, Takeshi; Tsuda, Hiroshi (2016). "De-identification and Encryption Technologies to Protect Personal Information" (PDF). Fujitsu Scientific and Technical Journal. 52 (3): 28–36.
- ^ .
- ^ Coop, Alex. "Sidewalk Labs decision to offload tough decisions on privacy to third party is wrong, says its former consultant". IT World Canada. Retrieved 27 June 2019.
- ^ PMID 16627725.
- ^ S2CID 5964522.
- PMID 18769715.
- National Archives.
- ^ "De-Identification 201". Privacy Analytics. 2015.
- ^ 45 CFR 164.512)
External links
- Simson L. Garfinkel (2015-12-16). "NISTIR 8053, De-Identification of Personal Information" (PDF). NIST. Retrieved 2016-01-03.
- A training series Archived 2015-11-13 at the Wayback Machine on United States government de-identification standards
- Guidance Regarding Methods for De-identification of Protected Health Information Archived 2015-12-10 at the Wayback Machine
- Ohm, Paul (2010). "Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization" (PDF). UCLA Law Review. 57: 1701–77.
- Padilla-López, José Ramón; Chaaraoui, Alexandros Andre; Flórez-Revuelta, Francisco (June 2015). "Visual privacy protection methods: A survey" (PDF). Expert Systems with Applications. 42 (9): 4177–4195. S2CID 6794899.
- Chaaraoui, Alexandros; Padilla-López, José; Ferrández-Pastor, Francisco; Nieto-Hidalgo, Mario; Flórez-Revuelta, Francisco (20 May 2014). "A Vision-Based System for Intelligent Monitoring: Human Behaviour Analysis and Privacy by Context". Sensors. 14 (5): 8895–8925. PMID 24854209.