4 ms·

From my observations, for data vendors "anonymization" generally just involves replacing a name or credit card number with some other identifier. That's the rea

by lemax 7y ago

From my observations, for data vendors "anonymization" generally just involves replacing a name or credit card number with some other identifier. That's the reality and that's all they are required to do by regulators. People on both sides of the market know and leverage this. There are legitimate use cases that people are after that can only be achieved by having the ability to correlate pseudonymous entities with some kind of history. Lots of data sets would be significantly less valuable, and lots of industry standard analyses unachievable with those identifiers out of the picture. As long as there is no Personally Identifiable Information (which, no, metadata, location history, medical claims, transaction details, don't count). I would imagine that this is something regulators are aware of and that the privacy tradeoff has just been shrugged off so that the market can carry on and do its thing.

pdkl95 7y ago
> "anonymization" generally just involves replacing a name or credit card number with some other identifier. DJB's description of "anonymization" while talking[1] about his job as the man in the middle at Verizon: >> Hashing is magic crypto pixie-dust, which takes personally identifiable information and makes it incomprehensible to the marketing department. When a marketing person looks at random letters and numbers they have no idea what it means. They can't imagine that anybody could possibly understand the information, reverse the hash, correlate the hashes, track them, save them, record them. > lots of industry standard analyses unachievable with those identifiers out of the picture. Calling something "standard" doesn't mean it's ethical. If someone wants use that type of identifier, they need to get explicit informed consent from everyone involved, and they need to be liable for any damages that derive from their database of identified records. [1] https://projectbullrun.org/surveillance/2015/video-2015.html#bernstein https://projectbullrun.org/surveillance/2015/video-2015.html...
rhizome 7y ago
>Lots of data sets would be significantly less valuable, and lots of industry standard analyses unachievable with those identifiers out of the picture. I'm fine with this. >As long as there is no Personally Identifiable Information (which, no, metadata, location history, medical claims, transaction details, don't count). Currently. Hopefully the stroke of a pen will eventually change this, and soon.
titzer 7y ago
> generally just involves replacing a name or credit card number with some other identifier. This is also often the case with location data as well. Spoiler alert: this is absolutely not sufficient to anonymize location data.

by lemax 7y ago

pdkl95 7y ago

> "anonymization" generally just involves replacing a name or credit card number with some other identifier. DJB's description of "anonymization" while talking[1] about his job as the man in the middle at Verizon: >> Hashing is magic crypto pixie-dust, which takes personally identifiable information and makes it incomprehensible to the marketing department. When a marketing person looks at random letters and numbers they have no idea what it means. They can't imagine that anybody could possibly understand the information, reverse the hash, correlate the hashes, track them, save them, record them. > lots of industry standard analyses unachievable with those identifiers out of the picture. Calling something "standard" doesn't mean it's ethical. If someone wants use that type of identifier, they need to get explicit informed consent from everyone involved, and they need to be liable for any damages that derive from their database of identified records. [1] https://projectbullrun.org/surveillance/2015/video-2015.html#bernstein https://projectbullrun.org/surveillance/2015/video-2015.html...

rhizome 7y ago

>Lots of data sets would be significantly less valuable, and lots of industry standard analyses unachievable with those identifiers out of the picture. I'm fine with this. >As long as there is no Personally Identifiable Information (which, no, metadata, location history, medical claims, transaction details, don't count). Currently. Hopefully the stroke of a pen will eventually change this, and soon.

titzer 7y ago

> generally just involves replacing a name or credit card number with some other identifier. This is also often the case with location data as well. Spoiler alert: this is absolutely not sufficient to anonymize location data.