As one of the poeple who broke the anonymity of the first Netflix Prize dataset, here's my take on why this is an issue we should worry about. First, some li

As one of the poeple who broke the anonymity of the first Netflix Prize dataset, here's my take on why this is an issue we should worry about. First, some links: Paul Ohm's paper on the consequences of re-identification for privacy laws and public policy: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1450006 http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1450006 Ohm's article about Netflix Prize 2: http://freedom-to-tinker.com/blog/paul/netflixs-impending-still-avoidable-multi-million-dollar-privacy-blunder http://freedom-to-tinker.com/blog/paul/netflixs-impending-st... Our FAQ about the re-identification attack on the first dataset: http://www.cs.utexas.edu/~shmat/netflix-faq.html http://www.cs.utexas.edu/~shmat/netflix-faq.html An excerpt from our paper, showing the kind of information you can learn about a person just from movie preferences: First, his political orientation may be revealed by his strong opinions about “Power and Terror: Noam Chomsky in Our Times” and “Fahrenheit 9/11,” and his religious views by his ratings on “Jesus of Nazareth” and “The Gospel of John.” Even though one should not make inferences solely from someone’s movie preferences, in many workplaces and social settings opinions about movies with predominantly gay themes such as “Bent” and “Queer as folk” (both present and rated in this person’s Netflix record) would be considered sensitive. In any case, it should be for the individual and not for Netflix to decide whether to reveal them publicly. A quote from Paul Ohm on why this is problematic even if no one cares about movie privacy: The "accretion problem" is this: once an adversary has linked two anonymized databases together, he can add the newly linked data to his collection of outside information and use it to help unlock other anonymized databases. ... Because of the accretion problem, every reidentification event, no matter how seemingly benign, brings people closer to harm. Had Narayanan and Shmatikov not been restricted by academic ethical standards (not to mention moral compunction), they might have connected people to harm themselves. He then goes on to postulate the "database of ruin": It is as if reidentification and the accretion problem join the data from all of the databases in the world together into one, giant, database-in-the-sky, an irresistible target for the malevolent. At a first reading, this might all sound like science fiction, but it's a lot more plausible than most people think. On my blog http://33bits.org/ http://33bits.org/ I have several more examples of re-identification. And let's not forget that there are companies such as Acxiom and Choicepoint which already specialize in aggregating every available piece of information about people, and then selling it.