5 ms·

I'm a programmer in the GP data analysis world. We use the term 'pseudonymization' for this kind of data. 'Anonymization' is used solely to refer to, say, 'the

I'm a programmer in the GP data analysis world. We use the term 'pseudonymization' for this kind of data. 'Anonymization' is used solely to refer to, say, 'the sum total of diabetes patients this practice has' (that would be anonymous patient data; it would not be anonymous relative to the GP office this refers to): Aggregated data that can no longer be reduced to a single individual at all. The term raises questions: Okay, so, what does it mean? How 'pseudo' is psuedo? And that's the point: When you pseudonimize data, you must ask those questions and there is no black and white anymore. My go-to example to explain this is very simple: Let's say we reduce birthdate info to just your birthyear, and geoloc info to just a wide area. And then I have an pseudonimized individual who is marked down as being 105 years old. Usually there's only one such person. I invite everybody who works in this field to start using the term 'pseudonimization'.

cheez 7y ago
It doesn't roll off the tongue, perhaps pseudo-anonymization is enough.
- gervu 7y ago
  Pseudonymization already refers to reference by pseudonym. Pseudonimization is bad terminology in that it's indistinct from the above, to the point that parent has already mixed the two up while in the process of recommending it. And it'd be worse verbally. "Pseudo-anonymization" could work, but something like "breakable anonymization" or "partial anonymization" might be better in that it's more obvious to a reader and doesn't rely on familiarity with technical terminology to convey the idea. I'd go with breakable, myself, since it's most to the point about why it's a problem. Pseudo is etymologically correct, but that doesn't necessarily help us much when the goal is ratio and ease of understanding by a wide population of readers. Partial could work in the sense that you did part of the job, which people would hopefully understand is a bit like having locked the back door for the night while leaving the front propped wide open. And there are probably other good options. If I was writing about this topic often, I'd strongly consider brainstorming a few more and running a user test where I ask random people to explain each term, then go with what consistently gets results closest to what I'm trying to discuss.
  - nobrains 7y ago
    Its not partial. Its pseudo.
    - deleted 7y ago
      [deleted]
  - washadjeffmad 7y ago
    'Pseudononymization' is how my brain read it. It's a fairly self-explanatory portmanteau with little chance of confusion on the root.
    - gervu 7y ago
      "Pseudonymization but with an extra syllable" sounds just as confusing as the other two. I wouldn't be sure which of those words I was looking at on first glance, which is what you'd need for it to be casually readable.
  - hiccuphippo 7y ago
    ESL here, what's wrong with pseudonymization as a derivative of pseudonym? I think it brings the point across. But if we want to stop beating around the bush, what about "nameless identification"?
    - deleted 7y ago
      [deleted]
    - WhitneyLand 7y ago
      >if we want to stop beating around the bush, what about "nameless identification"? The difference is the other proposed alternatives more directly suggest risk is involved. It's a nice ESL example because technically, I don't think you're suggestion is wrong. In practice I think few would infer its implications.
- BerislavLopac 7y ago
  I would suggest "denonymization", implying that the "names" (i.e. identifiable information) were removed. As opposed to anonymous data, which presumably never had any to start with, like the example mentioned by the GP.
  - leetcrew 7y ago
    from an etymological perspective, this is kind of gross; you are grafting a latin-derived prefix onto a greek-derived stem. there's no direct Greek equivalent to the Latin "de", but you could consider "apo" or possibly "kata", both of which have similar meanings.
  - jobigoud 7y ago
    > I would suggest "denonymization" Very very close to the existing "deanonymization" which is essentially the opposite.
- shardinator 7y ago
  Just joking, but how about 'nonymisation' or 'non-nonimysation'
- Zenst 7y ago
  True, maybe call it "redacted with a highlighting pen" as appears to get the same results.
philbarr 7y ago
When I worked in the data analysis world, we would have a bounds for this stuff. Number of people >100 in the area: <10
mgkimsal 7y ago
I worked on a reporting/dataviz project a few years back, showing survey results from states/districts/schools. All the data was included in the totals, but if a school had 5 or fewer responses, we didn't allow viewing of the school data. It was specifically because being able to see answers to things like "do you support your principal?" when there were only, say, 3 teachers at a school, and seeing 2 for "no"... it was way too easy to determine who the respondents were. Even with '5' as a cutoff, it still felt a bit dicey for some schools.
TadaScientist 7y ago
Pseudo and psuedo are derived from the greek work ψεμα psema, which literally means lie. It's synonym is 'untrue' which indicates that your term is the right term to use when anonymizing-but-not-really-anonymizing
- contravariant 7y ago
  In this case it might not be 'pseudo'-anonymization but rather 'pseudonym'-ization. At least that seemed to be the intent when I last heard the term.
abcc8 7y ago
We refer to such data as deidentified.
martin-adams 7y ago
I'll coin the phrase Sominization, where 'some' attempt to anonymize the data, and as such, should be used with great caution.
dalbasal 7y ago
A related/derivative concept that ties into the existing lexicon is name Vs pseudonym. Bitcoin for example, uses pseudonyms... not anonymity. A pen name or a hn username is a pseudonym. A voting system needs to be anonymous not pseudo-anonymous^, by using a pseudonym. If each voter had a secret number that is attached to each vote, that is a pseudonym. "L is 32 years old. She works as a nurse in Moscow." - L is a pseudonym. It isn't anonymous even though the name is ommitted. ^This can get grey, as even a piece of paper with an X on it will carry certain metadata or related data: which voting booth, etc. But, the goal is anonymity. IE, the X cannot be tied to anything else.
- doomjunky 7y ago
  Rektor Seymour Skinner: "A certain agitator let's call her Lisa S. no that's too obvious let's say L. Simpson." [S07E05]
mcintyre1994 7y ago
We covered this in a DB course with the term k-anonymity which seems to be standard in the literature, where a dataset is k-anonymous if every combination of characteristics (that can identify users) has at least K users. So in your case that dataset has only the 1-anonymity property, but you can set a k>1 and change the data set to satisfy it and improve the anonymity. Eg. if age was just stored as 90+ and there's at least 10 90+ year olds in each wide area then you'd get 10-anonymity. I guess then the interesting question is how high does k have to be to call it anonymous vs pseudonymous. Also cool: this is how Have I been Pwned v2 works - if you send only the first 5 characters of a hash then it's guaranteed there's hundreds of matches and the server doesn't know the real password that had that hash prefix: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...
- SkyBelow 7y ago
  >I guess then the interesting question is how high does k have to be to call it anonymous vs pseudonymous. I think that for any size k less than the total size of the database, it is not anonymous. In cases like this, an overly strict definition favoring privacy is the only way to protect people. Similar to how we call 17 year olds children and treat them as such under law even though a 17 year old is far closer to an 18 year old than they are to a 5 year old (yes, there are some exceptions, but these are all explicitly called out). Another example of such an extreme is concerning falsifying data or making false statements. Even a single such statement, regardless of the number of true statements, destroys credibility once found when trust is extremely important. This is why even a single such statement can get one found in contempt of court or destroy a scientist's entire career (and even cast doubt on peers who were innocent). Overall it is quite messy because it is a mix of a technical problem with a people problem.
  - Shendare 7y ago
    > I think that for any size k less than the total size of the database, it is not anonymous. Wouldn't that require that every field of every record in the database be globally unique? If something as simple as gender is a field in the database, the best k you could get would be the lowest count of records of each existent gender option.
jklehm 7y ago
As far as health data is concerned the regulation is very clear that any aggregates must have a certain minimum amount in bin for precisely this reason.
lmkg 7y ago
> My go-to example to explain this is very simple: Let's > say we reduce birthdate info to just your birthyear, > and geoloc info to just a wide area. And then I have > an pseudonimized individual who is marked down as > being 105 years old. > Usually there's only one such person. I was interested to find that HIPAA's requirements for de-identification address the two particular issues you pointed out. First, age above some threshold (90) must be bucketed together as "older than 90." Second, regarding ZIP codes: you must zero out the last two digits. And then, if the resulting identifier contains less than 20,000 inhabitants according to the most recent US census, you have to blank the first three digits as well (there are currently 17 such three-digit prefixes). Source: Pages 96-97 of the combined legislation, available at: https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/combined-regulation-text/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg... You are allowed to roll your own de-identification method, as long as the person doing so is an expert on statistics and de-identification and they document their analysis of why their method is sound. To my knowledge, most entities use the "safe harbor" approach of wiping any data in the legislated blacklist of dimensions.
- dwild 7y ago
  Theses are pretty good ways to anonymize theses fields, but they are still just good if only that field is used. Let say that you got 20,000 inhabitants, you'll only need about 14 fields that are binary, much less fields if they are not binary (which is quite likely to happen). You'll most likely already got the gender... Even if you limit the age to 10 possible values, that's equivalent to 3 binary fields!
heavenlyblue 7y ago
>> Aggregated data that can no longer be reduced to a single individual at all. Even aggregated data will loose the anonymisation characteristics when we are speaking of low volumes of data. Number of cancer patients in the area A: 1 Number of residents in the area A: 1
- doomjunky 7y ago
  Even for big numbers, if x = 100% or x = 0%

cheez 7y ago

It doesn't roll off the tongue, perhaps pseudo-anonymization is enough.

gervu 7y ago
Pseudonymization already refers to reference by pseudonym. Pseudonimization is bad terminology in that it's indistinct from the above, to the point that parent has already mixed the two up while in the process of recommending it. And it'd be worse verbally. "Pseudo-anonymization" could work, but something like "breakable anonymization" or "partial anonymization" might be better in that it's more obvious to a reader and doesn't rely on familiarity with technical terminology to convey the idea. I'd go with breakable, myself, since it's most to the point about why it's a problem. Pseudo is etymologically correct, but that doesn't necessarily help us much when the goal is ratio and ease of understanding by a wide population of readers. Partial could work in the sense that you did part of the job, which people would hopefully understand is a bit like having locked the back door for the night while leaving the front propped wide open. And there are probably other good options. If I was writing about this topic often, I'd strongly consider brainstorming a few more and running a user test where I ask random people to explain each term, then go with what consistently gets results closest to what I'm trying to discuss.
- nobrains 7y ago
  Its not partial. Its pseudo.
  - deleted 7y ago
    [deleted]
- washadjeffmad 7y ago
  'Pseudononymization' is how my brain read it. It's a fairly self-explanatory portmanteau with little chance of confusion on the root.
  - gervu 7y ago
    "Pseudonymization but with an extra syllable" sounds just as confusing as the other two. I wouldn't be sure which of those words I was looking at on first glance, which is what you'd need for it to be casually readable.
- hiccuphippo 7y ago
  ESL here, what's wrong with pseudonymization as a derivative of pseudonym? I think it brings the point across. But if we want to stop beating around the bush, what about "nameless identification"?
  - deleted 7y ago
    [deleted]
  - WhitneyLand 7y ago
    >if we want to stop beating around the bush, what about "nameless identification"? The difference is the other proposed alternatives more directly suggest risk is involved. It's a nice ESL example because technically, I don't think you're suggestion is wrong. In practice I think few would infer its implications.
BerislavLopac 7y ago
I would suggest "denonymization", implying that the "names" (i.e. identifiable information) were removed. As opposed to anonymous data, which presumably never had any to start with, like the example mentioned by the GP.
- leetcrew 7y ago
  from an etymological perspective, this is kind of gross; you are grafting a latin-derived prefix onto a greek-derived stem. there's no direct Greek equivalent to the Latin "de", but you could consider "apo" or possibly "kata", both of which have similar meanings.
- jobigoud 7y ago
  > I would suggest "denonymization" Very very close to the existing "deanonymization" which is essentially the opposite.
shardinator 7y ago
Just joking, but how about 'nonymisation' or 'non-nonimysation'
Zenst 7y ago
True, maybe call it "redacted with a highlighting pen" as appears to get the same results.

philbarr 7y ago

When I worked in the data analysis world, we would have a bounds for this stuff. Number of people >100 in the area: <10

mgkimsal 7y ago

I worked on a reporting/dataviz project a few years back, showing survey results from states/districts/schools. All the data was included in the totals, but if a school had 5 or fewer responses, we didn't allow viewing of the school data. It was specifically because being able to see answers to things like "do you support your principal?" when there were only, say, 3 teachers at a school, and seeing 2 for "no"... it was way too easy to determine who the respondents were. Even with '5' as a cutoff, it still felt a bit dicey for some schools.

TadaScientist 7y ago

Pseudo and psuedo are derived from the greek work ψεμα psema, which literally means lie. It's synonym is 'untrue' which indicates that your term is the right term to use when anonymizing-but-not-really-anonymizing

contravariant 7y ago
In this case it might not be 'pseudo'-anonymization but rather 'pseudonym'-ization. At least that seemed to be the intent when I last heard the term.

abcc8 7y ago

We refer to such data as deidentified.

martin-adams 7y ago

I'll coin the phrase Sominization, where 'some' attempt to anonymize the data, and as such, should be used with great caution.

dalbasal 7y ago

A related/derivative concept that ties into the existing lexicon is name Vs pseudonym. Bitcoin for example, uses pseudonyms... not anonymity. A pen name or a hn username is a pseudonym. A voting system needs to be anonymous not pseudo-anonymous^, by using a pseudonym. If each voter had a secret number that is attached to each vote, that is a pseudonym. "L is 32 years old. She works as a nurse in Moscow." - L is a pseudonym. It isn't anonymous even though the name is ommitted. ^This can get grey, as even a piece of paper with an X on it will carry certain metadata or related data: which voting booth, etc. But, the goal is anonymity. IE, the X cannot be tied to anything else.

doomjunky 7y ago
Rektor Seymour Skinner: "A certain agitator let's call her Lisa S. no that's too obvious let's say L. Simpson." [S07E05]

mcintyre1994 7y ago

We covered this in a DB course with the term k-anonymity which seems to be standard in the literature, where a dataset is k-anonymous if every combination of characteristics (that can identify users) has at least K users. So in your case that dataset has only the 1-anonymity property, but you can set a k>1 and change the data set to satisfy it and improve the anonymity. Eg. if age was just stored as 90+ and there's at least 10 90+ year olds in each wide area then you'd get 10-anonymity. I guess then the interesting question is how high does k have to be to call it anonymous vs pseudonymous. Also cool: this is how Have I been Pwned v2 works - if you send only the first 5 characters of a hash then it's guaranteed there's hundreds of matches and the server doesn't know the real password that had that hash prefix: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...

SkyBelow 7y ago
>I guess then the interesting question is how high does k have to be to call it anonymous vs pseudonymous. I think that for any size k less than the total size of the database, it is not anonymous. In cases like this, an overly strict definition favoring privacy is the only way to protect people. Similar to how we call 17 year olds children and treat them as such under law even though a 17 year old is far closer to an 18 year old than they are to a 5 year old (yes, there are some exceptions, but these are all explicitly called out). Another example of such an extreme is concerning falsifying data or making false statements. Even a single such statement, regardless of the number of true statements, destroys credibility once found when trust is extremely important. This is why even a single such statement can get one found in contempt of court or destroy a scientist's entire career (and even cast doubt on peers who were innocent). Overall it is quite messy because it is a mix of a technical problem with a people problem.
- Shendare 7y ago
  > I think that for any size k less than the total size of the database, it is not anonymous. Wouldn't that require that every field of every record in the database be globally unique? If something as simple as gender is a field in the database, the best k you could get would be the lowest count of records of each existent gender option.

jklehm 7y ago

As far as health data is concerned the regulation is very clear that any aggregates must have a certain minimum amount in bin for precisely this reason.

lmkg 7y ago

> My go-to example to explain this is very simple: Let's > say we reduce birthdate info to just your birthyear, > and geoloc info to just a wide area. And then I have > an pseudonimized individual who is marked down as > being 105 years old. > Usually there's only one such person. I was interested to find that HIPAA's requirements for de-identification address the two particular issues you pointed out. First, age above some threshold (90) must be bucketed together as "older than 90." Second, regarding ZIP codes: you must zero out the last two digits. And then, if the resulting identifier contains less than 20,000 inhabitants according to the most recent US census, you have to blank the first three digits as well (there are currently 17 such three-digit prefixes). Source: Pages 96-97 of the combined legislation, available at: https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/combined-regulation-text/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg... You are allowed to roll your own de-identification method, as long as the person doing so is an expert on statistics and de-identification and they document their analysis of why their method is sound. To my knowledge, most entities use the "safe harbor" approach of wiping any data in the legislated blacklist of dimensions.

dwild 7y ago
Theses are pretty good ways to anonymize theses fields, but they are still just good if only that field is used. Let say that you got 20,000 inhabitants, you'll only need about 14 fields that are binary, much less fields if they are not binary (which is quite likely to happen). You'll most likely already got the gender... Even if you limit the age to 10 possible values, that's equivalent to 3 binary fields!

heavenlyblue 7y ago

>> Aggregated data that can no longer be reduced to a single individual at all. Even aggregated data will loose the anonymisation characteristics when we are speaking of low volumes of data. Number of cancer patients in the area A: 1 Number of residents in the area A: 1

doomjunky 7y ago
Even for big numbers, if x = 100% or x = 0%