2 ms·

user_id is PII if the identity of a user can be narrowed down sufficiently. For example, if you created a social media app and later left the company, it could

by hnbad 4y ago

user_id is PII if the identity of a user can be narrowed down sufficiently. For example, if you created a social media app and later left the company, it could still be determined that if you had an account it likely has one of the lowest user ID values if those were assigned sequentially. So even if your name was removed from it and none of your posts provided any identifying information about you, the user ID could still qualify as PII. Likewise if the user ID is public and non-PII content associated with that ID is linked elsewhere identifying the author of that content (e.g. a news article embedding a post) the identity of the author is still compromised. The problem is not just that users may submit PII in unexpected places, the problem is that even if the data type could not possibly allow them to, metadata beyond your control may actually still taint your supposedly anonymous data.

afiori 4y ago
The question is not whether "spooky deanonymization as a distance" is possible; the question is how much you should proactively do to avoid this. As an extreme example, if user A takes a screenshot if their own user setting page on a image sharing site, then sends it to user B that uploads it to the same site. Who is responsible for this piece of data? does share-a-pic.web need to scan all images for the username of a user that is deleting an account? This is a convoluted example where the answer is obviously no, but it shows that a purely principled answer might be unsuitable. Especially since non PII data you own mixed with non PII data someone else owns can become PII and you do not know what data others have. (you could also replace the user ID in all locations with a new tagged UUID to preserve referential integrity in the DB, but there not much more than 2^32 humans in total, it s very hard not to be deanonymizable)

by hnbad 4y ago

afiori 4y ago

The question is not whether "spooky deanonymization as a distance" is possible; the question is how much you should proactively do to avoid this. As an extreme example, if user A takes a screenshot if their own user setting page on a image sharing site, then sends it to user B that uploads it to the same site. Who is responsible for this piece of data? does share-a-pic.web need to scan all images for the username of a user that is deleting an account? This is a convoluted example where the answer is obviously no, but it shows that a purely principled answer might be unsuitable. Especially since non PII data you own mixed with non PII data someone else owns can become PII and you do not know what data others have. (you could also replace the user ID in all locations with a new tagged UUID to preserve referential integrity in the DB, but there not much more than 2^32 humans in total, it s very hard not to be deanonymizable)