3 ms·

Pseudonymization is creating a new random identifier and keeping a linking table from those new identifiers to the original identifiers. Pseudonymized data is

Pseudonymization is creating a new random identifier and keeping a linking table from those new identifiers to the original identifiers. Pseudonymized data is for all intents and purposes completely anonymous as long as the people you share the data with cannot access the linking table. That constraint can be enforced technically, contractually, or legally, depending on how important the breach would be.

willseth 3y ago
It's pseudonymization regardless of the replacement data format. It can be a token, a format-consistent value, e.g. "john.smith@example.com", redacted, etc. All of that is considered pseudonymous. Pseudonymized data is not completely anonymous. For example, your name, address, date of birth, and other identifiable information are likely available in public datasets like property tax records or voter registration data. There are also mostly-legal datasets available for purchase with more complete demographic and personal information. If your birthday, gender, and zipcode are present in the pseudonymized dataset, I have an ~87% chance succeeding in a linkage attack matching you in of those public datasets.
- Dayshine 3y ago
  If your birthday, gender, and zip code are present in the dataset then it is not Pseudonymized. By definition in any modern privacy specification, the only difference between anonymous and pseudonymous is that you can recover the true identity. I believe a decade plus ago Pseudonymized meant simply making something less identifiable, but not any more.
  - willseth 3y ago
    That's not how the term typically used. Most people will assume you have only protected direct identifiers if you tell them data has been pseudonymized. https://csrc.nist.gov/glossary/term/pseudonymization https://csrc.nist.gov/glossary/term/pseudonymization
    - Dayshine 3y ago
      https://en.m.wikipedia.org/wiki/Pseudonymization https://en.m.wikipedia.org/wiki/Pseudonymization See section about the new definition under GDPR. Like I said, modern privacy standards. The US is still quite far behind: I've had to do HIPAA training and it shows. I'd advise you to set your bar a lot higher than your national standards if you ever plan to do international products: nobody in the US will complain if you use stricter definitions but you'll instantly be rejected in Europe if you call that pseudonymization.
      - willseth 3y ago
        What bar are you talking about? We use the state of the art to treat indirect identifiers without pseudonymization, but we pseudonymize as needed if that’s overkill. The bar is set very high for our service. Sadly, very few companies are actually interested in treating indirect identifiers or consider anything besides direct identifiers a problem. I’m familiar with GDPR, we work with EU companies, and all the ones we work with use original definition. NIST link aside, these terms are hardly standards anyway. They are nearly colloquial vocabulary, which unfortunately in this space I expect to remain imprecise and vague. This why we generally only use it in marketing and comms, while in the actual product we drill down into specifications for direct and indirect identifiers, distortion, and risk.
- mbork_pl 3y ago
  For the curious: more about the 87% figure, with a link to the source paper: https://www.johndcook.com/blog/2018/12/07/simulating-zipcode-sex-birthdate/ https://www.johndcook.com/blog/2018/12/07/simulating-zipcode.... (Not the author, just a fan of John D. Cook's blog.)
jandrewrogers 3y ago
Many red-teaming attacks don't rely on the identifiers at all, they are essentially "duck typing" the entities in the data model. Same approach is commonly used for dealing with data where a single identity may have multiple pseudonymized identifiers. There are a bunch of regulatory box-checking exercises like this that don't actually provide anonymization if the attacker is sophisticated.

willseth 3y ago

It's pseudonymization regardless of the replacement data format. It can be a token, a format-consistent value, e.g. "john.smith@example.com", redacted, etc. All of that is considered pseudonymous. Pseudonymized data is not completely anonymous. For example, your name, address, date of birth, and other identifiable information are likely available in public datasets like property tax records or voter registration data. There are also mostly-legal datasets available for purchase with more complete demographic and personal information. If your birthday, gender, and zipcode are present in the pseudonymized dataset, I have an ~87% chance succeeding in a linkage attack matching you in of those public datasets.

Dayshine 3y ago
If your birthday, gender, and zip code are present in the dataset then it is not Pseudonymized. By definition in any modern privacy specification, the only difference between anonymous and pseudonymous is that you can recover the true identity. I believe a decade plus ago Pseudonymized meant simply making something less identifiable, but not any more.
- willseth 3y ago
  That's not how the term typically used. Most people will assume you have only protected direct identifiers if you tell them data has been pseudonymized. https://csrc.nist.gov/glossary/term/pseudonymization https://csrc.nist.gov/glossary/term/pseudonymization
  - Dayshine 3y ago
    https://en.m.wikipedia.org/wiki/Pseudonymization https://en.m.wikipedia.org/wiki/Pseudonymization See section about the new definition under GDPR. Like I said, modern privacy standards. The US is still quite far behind: I've had to do HIPAA training and it shows. I'd advise you to set your bar a lot higher than your national standards if you ever plan to do international products: nobody in the US will complain if you use stricter definitions but you'll instantly be rejected in Europe if you call that pseudonymization.
    - willseth 3y ago
      What bar are you talking about? We use the state of the art to treat indirect identifiers without pseudonymization, but we pseudonymize as needed if that’s overkill. The bar is set very high for our service. Sadly, very few companies are actually interested in treating indirect identifiers or consider anything besides direct identifiers a problem. I’m familiar with GDPR, we work with EU companies, and all the ones we work with use original definition. NIST link aside, these terms are hardly standards anyway. They are nearly colloquial vocabulary, which unfortunately in this space I expect to remain imprecise and vague. This why we generally only use it in marketing and comms, while in the actual product we drill down into specifications for direct and indirect identifiers, distortion, and risk.
mbork_pl 3y ago
For the curious: more about the 87% figure, with a link to the source paper: https://www.johndcook.com/blog/2018/12/07/simulating-zipcode-sex-birthdate/ https://www.johndcook.com/blog/2018/12/07/simulating-zipcode.... (Not the author, just a fan of John D. Cook's blog.)

jandrewrogers 3y ago

Many red-teaming attacks don't rely on the identifiers at all, they are essentially "duck typing" the entities in the data model. Same approach is commonly used for dealing with data where a single identity may have multiple pseudonymized identifiers. There are a bunch of regulatory box-checking exercises like this that don't actually provide anonymization if the attacker is sophisticated.