2 ms·
For this attack to work, wouldn't one of the tables need to contain PII of some sort? If A,B,C,D,E are all de-identified, the aggregate is still de-identified?
by alistairSH 5y ago
For this attack to work, wouldn't one of the tables need to contain PII of some sort? If A,B,C,D,E are all de-identified, the aggregate is still de-identified? But, if E is SSN (or some other PII data), then the entire set can be re-identified?
- taejo 5y agoThat's one option: you combine protected, de-identified information with unprotected (e.g. non-health) information to re-identify the protected information. But also, something like Facebook allows you to target a person who lives in $TOWN, works at $COMPANY, born in $YEAR, even if you don't know that person's name or SSN.