Korra team · · 3 min read
De-identified is not anonymous: what data buyers need to know
De-identified data has had direct identifiers removed. Anonymous data cannot be tied back to a person at all. Most business data you can license is the first kind.
De-identified and anonymous are different claims. De-identified data has had names and other direct identifiers removed or replaced. Anonymous data cannot be tied back to a person at all, and most business data on offer does not meet that bar.
What is the difference between de-identified and anonymous data?
The regulators define anonymous narrowly.
The Federal Trade Commission put it in one line: “data is only anonymous when it can never be associated back to a person.” It added that companies often act as if data that lacks clearly identifying information is anonymous, and that this is a common source of wrong privacy claims.
European law takes the same view. Recital 26 of the GDPR says personal data that has been pseudonymised, and that could be attributed to a person by the use of additional information, should still be treated as information on an identifiable person. Pseudonymised means the identifiers were replaced with stand-ins.
The UK’s Information Commissioner’s Office describes anonymous information as data that does not relate to an identified or identifiable person. Data protection law does not apply to it. That is why the word carries so much weight, and why you should not accept it loosely.
De-identified
- Names and direct identifiers removed or replaced
- A person may still be found with other data
- Privacy law can still apply
- Needs contract limits and care
Anonymous
- Nobody can be identified by any likely means
- A high bar that few detailed datasets meet
- Data protection law does not apply
- Must stay true as technology improves
Why can de-identified business data still point to a person?
Business records are detailed, and detail identifies people. There are three common routes.
- LinksRecords that stay connected across systems can be followed back to one person.
- Small groupsIn a small team, a role and a date can be enough.
- ContentThe message itself can say who wrote it, even with the name gone.
The Spirit Airlines data sale gives a live example of the first two. The Association of Flight Attendants-CWA objected that the sale agreement requires de-identification to preserve “referential integrity across the data set”, so the links that let records be followed across systems stay in place. The union said that, with a group the size of its membership, information about identifiable individuals or small identifiable groups might still be reconstructed.
Buyers want those links. A support case is only useful when the request, the work and the result stay together. The same links are what make re-identification possible. You cannot have one without accepting some of the other, so plan for it.
The Record reported that 121 federal lawmakers made the same argument in a letter about that sale: “Removing names, email addresses, or other direct identifiers does not necessarily make a dataset anonymous.”
What do sellers and intermediaries say about their own process?
The careful ones do not claim anonymity.
Handshake AI, which licenses company data, says on its own page that its process is designed to reduce the risk of re-identification, and that “no de-identification process eliminates that risk entirely.” It adds that a third party may be able to re-identify personal information in combination with other data sources.
Read that as the honest standard. If a seller tells you a detailed dataset of emails and chats is anonymous, ask how they tested it.
What does “all the means reasonably likely” mean for a buyer?
The GDPR recital sets the test. To decide whether a person is identifiable, account should be taken of all the means reasonably likely to be used, by the controller or by another person. The factors include the cost, the time required, and the technology available at the time and as it develops.
Two things follow for you:
- You are part of the test. If you hold other data that could be matched to the licensed set, the risk is higher in your hands than in the seller’s.
- The answer can change. Data that is hard to re-identify today may be easier later. A model that can read and connect free text makes that more likely, not less.
What should you ask for?
Treat de-identified data as data that still needs care.
- Ask what was removed, what was replaced, and what was left in on purpose.
- Ask whether an independent party did the work, and whether there is a record of the method.
- Ask which small groups are in the data: a team of four, a single office, one named client.
- Put a no re-identification clause in the licence, and pass it to anyone who gets the data from you.
- Keep the licensed set apart from data that could be matched to it.
On Korra the public card is de-identified, and our pages say so in those words. We say that removing names does not make data anonymous, and every card is confidential under the buyer agreement. The sample and the full data come from the seller under your licence, so these questions are yours to ask. See how buying works and our page on data privacy.
Questions
- Is pseudonymised data anonymous?
- No. Recital 26 of the GDPR says pseudonymised data that could be attributed to a person with additional information should be treated as information on an identifiable person.
- Does hashing an email address make it anonymous?
- No. The Federal Trade Commission says a hash is still a unique signature that can be used to identify and track a person, and that companies should not claim hashing makes personal information anonymous.
- Can a contract replace de-identification?
- No, the two work together. De-identification lowers the chance that a person is found. The contract says nobody will try, and says what happens if someone does.
- Why not remove every link between records?
- Because the links carry the value. A request, the work and the result are only useful together. The answer is to keep the links, limit who has the data, and forbid re-identification.
Sources
- No, hashing still doesn’t make your data anonymous — Federal Trade Commission
- Recital 26 - Not Applicable to Anonymous Data — GDPR
- Introduction to anonymisation — Information Commissioner’s Office
- Spirit Bankruptcy: Objection to Sale of Your Data — Association of Flight Attendants-CWA
- Lawmakers warn Google could expose Spirit Airlines data in $10 million AI training deal — The Record
- Data Partnerships — Handshake AI
Figures are as reported by the publishers above. Discussion threads show what people said; they are not facts or Korra results.
