5 ms·

I am sorry, but your answer is nearly the exact textbook example how wrong most people are with their intuition. In 2000 Latanya Sweeney showed that 87% of Amer

I am sorry, but your answer is nearly the exact textbook example how wrong most people are with their intuition. In 2000 Latanya Sweeney showed that 87% of Americans can be identified by Sex, Birthday and Zip-Code. As other commenters point out, the connection to external databases is extremely powerful and dangerous to privacy. There are other concept in research to still use this data in research like differential privacy or using KI to synthesize data according to training data provided. But so far all concepts that tried to alter and then publish a datasets directly for research failed miserably.

giovannibonetti 5y ago
The parent comment mentioned birth year, not birthday
ghaff 5y ago
In fairness, the parent did just say Birth Year and Sex while Latanya Sweeney used the identifiers you list which give quite a bit more information. I agree with your basic point though that data that appears to be anonymized can frequently be de-anonymized--at least to some degree of statistical certainty to a degree that most would find surprising.
prepend 5y ago
Birthday is super different than year of birth. And zip code is really precise. GP said sex and year of birth that are usually perfectly fine for deidentification assuming some basic k-anonymity and l-diversity protections. It’s frustrating when people bring up examples of reidentification out of data that were not properly reidentified in the first place. Hopefully no one competent would think that having unique records based on sex, dob, and zip code are makes data deidentified. This is usually the case of someone not actually deidentified. The bigger risk, I think, is when you have some threshold of at least 10 records sharing sex, year of birth and still iding individuals.
- jfrunyon 5y ago
  Sure, sex and year of birth alone are fine. Why do you assume they won't be able to use the medical data to further de-anonymize it? "Male, 1993, records are from a hospital in Central Texas so he lives there, who has posted on social media about conditions x, y and z" would probably turn up... me.
  - prepend 5y ago
    That is exactly my concern. But that’s not what but my comment was about the false statement from Sweeney’s paper talking about zip, dob and no one considers that deidentified.
cortesoft 5y ago
Sex, birthday, and zip code is totally different than sex and birth year… sex, birthday, and zip code creates 1,523,000,000 different ‘buckets’ of people for everyone born in the last 50 years. That is more buckets than people in the US, so it makes sense that you could deanonymize. Sex and birth year only creates 100 total buckets for people born in the last 50 years. There is no way you could deanonymize that.
- labawi 5y ago
  Correct on the differences. True, it cannot be deanonymized if that is the only data you have. However, if you have any other data, even if it is not PII by itself and doesn't even look interesting, there is no way to guarantee it won't be personally identifiable when combined. As has been said, I don't think there is a way to anonymize data, that is useful and not reversible when combined with other data. Even if you only have 2 buckets.

giovannibonetti 5y ago

The parent comment mentioned birth year, not birthday

ghaff 5y ago

In fairness, the parent did just say Birth Year and Sex while Latanya Sweeney used the identifiers you list which give quite a bit more information. I agree with your basic point though that data that appears to be anonymized can frequently be de-anonymized--at least to some degree of statistical certainty to a degree that most would find surprising.

prepend 5y ago

Birthday is super different than year of birth. And zip code is really precise. GP said sex and year of birth that are usually perfectly fine for deidentification assuming some basic k-anonymity and l-diversity protections. It’s frustrating when people bring up examples of reidentification out of data that were not properly reidentified in the first place. Hopefully no one competent would think that having unique records based on sex, dob, and zip code are makes data deidentified. This is usually the case of someone not actually deidentified. The bigger risk, I think, is when you have some threshold of at least 10 records sharing sex, year of birth and still iding individuals.

jfrunyon 5y ago
Sure, sex and year of birth alone are fine. Why do you assume they won't be able to use the medical data to further de-anonymize it? "Male, 1993, records are from a hospital in Central Texas so he lives there, who has posted on social media about conditions x, y and z" would probably turn up... me.
- prepend 5y ago
  That is exactly my concern. But that’s not what but my comment was about the false statement from Sweeney’s paper talking about zip, dob and no one considers that deidentified.

cortesoft 5y ago

Sex, birthday, and zip code is totally different than sex and birth year… sex, birthday, and zip code creates 1,523,000,000 different ‘buckets’ of people for everyone born in the last 50 years. That is more buckets than people in the US, so it makes sense that you could deanonymize. Sex and birth year only creates 100 total buckets for people born in the last 50 years. There is no way you could deanonymize that.

labawi 5y ago
Correct on the differences. True, it cannot be deanonymized if that is the only data you have. However, if you have any other data, even if it is not PII by itself and doesn't even look interesting, there is no way to guarantee it won't be personally identifiable when combined. As has been said, I don't think there is a way to anonymize data, that is useful and not reversible when combined with other data. Even if you only have 2 buckets.