4 ms·

No, but there's really no such thing as anonymous anymore given the corpus of data a company such as Facebook or Google have. Once they have just a few "anonymo

No, but there's really no such thing as anonymous anymore given the corpus of data a company such as Facebook or Google have. Once they have just a few "anonymous" clues, such as zip code, year of birth, race, etc. they can probably connect any datum with an individual with pretty high accuracy.

tantalor 8y ago
> "anonymous" clues, such as zip code, year of birth, race Those are examples of PII, not "anonymous"
- gowld 8y ago
  It's not so clear-cut. https://en.wikipedia.org/wiki/Personally_identifiable_information https://en.wikipedia.org/wiki/Personally_identifiable_inform... And that's the point. Anything can add up to PII if you have enough clues. PII is a statistical concept, not a binary concept.
  - KaiserPro 8y ago
    in the EU, its a legal concept. its anything that can be reasonably used to identify a person.
    - ams6110 8y ago
      So by itself, medical data by birth year is not enough to identify a person. It's just statistics. Same as by race, or any other single characteristic. But when combined, and matched against the kind of individual detailed data that Google or Facebook have about most of the population, it's a lot less anonymous.
      - KaiserPro 8y ago
        In the old Data protection Act, it was any data when combined with public records. In the new GDPR, as far as I'm aware, its the _act_ of trying to combine/process (not sure of the exact wording) to de-anonymise
    - vharuck 8y ago
      >its anything that can be reasonably used to identify a person. This bar moves over time, especially as people share more (not health-related) personal information with companies.
- Bartweiss 8y ago
  Under HIPAA at least, zip code is the only "protected health information" in that list - and even then three digits of it can be shared if they apply to a large enough population. HIPAA permits two de-idenficiation methods. One, expert analysis, will presumably catch things like demographic identifiers. The other, safe harbor, offers a concrete list of data to remove - and that list leaves an absolutely massive amount of PII unrestricted.

tantalor 8y ago

> "anonymous" clues, such as zip code, year of birth, race Those are examples of PII, not "anonymous"

gowld 8y ago
It's not so clear-cut. https://en.wikipedia.org/wiki/Personally_identifiable_information https://en.wikipedia.org/wiki/Personally_identifiable_inform... And that's the point. Anything can add up to PII if you have enough clues. PII is a statistical concept, not a binary concept.
- KaiserPro 8y ago
  in the EU, its a legal concept. its anything that can be reasonably used to identify a person.
  - ams6110 8y ago
    So by itself, medical data by birth year is not enough to identify a person. It's just statistics. Same as by race, or any other single characteristic. But when combined, and matched against the kind of individual detailed data that Google or Facebook have about most of the population, it's a lot less anonymous.
    - KaiserPro 8y ago
      In the old Data protection Act, it was any data when combined with public records. In the new GDPR, as far as I'm aware, its the _act_ of trying to combine/process (not sure of the exact wording) to de-anonymise
  - vharuck 8y ago
    >its anything that can be reasonably used to identify a person. This bar moves over time, especially as people share more (not health-related) personal information with companies.
Bartweiss 8y ago
Under HIPAA at least, zip code is the only "protected health information" in that list - and even then three digits of it can be shared if they apply to a large enough population. HIPAA permits two de-idenficiation methods. One, expert analysis, will presumably catch things like demographic identifiers. The other, safe harbor, offers a concrete list of data to remove - and that list leaves an absolutely massive amount of PII unrestricted.