As organizations collect and analyze increasing amounts of consumer information, the limitations of traditional data anonymization have become impossible to ignore. New academic research demonstrates that supposedly anonymous datasets can often be re-identified with remarkable accuracy, raising serious questions about whether existing privacy protections are sufficient under modern regulations such as GDPR. These findings reinforce the need for organizations to rethink how they handle sensitive information and adopt more privacy-preserving approaches to data sharing and analytics.
Emerging technologies offer a promising path forward. Self-sovereign identity frameworks give individuals greater control over their personal information, while synthetic data enables organizations to perform meaningful analysis without exposing real consumer records. Together, these approaches can help balance innovation, regulatory compliance, and consumer privacy in an increasingly data-driven economy.
Researchers in European universities solidify past research that proves just how easy it is to reconstruct anonymized data back into personalized data. This proves, once again, that people must be given control over their data and, even then, released data should be converted into synthetic data because, at the moment, too much detailed consumer data is being released, putting many people at risk.
“Researchers from two universities in Europe have published a method they say is able to correctly re-identify 99.98% of individuals in anonymized data sets with just 15 demographic attributes.
Their model suggests complex data sets of personal information cannot be protected against re-identification by current methods of “anonymizing” data — such as releasing samples (subsets) of the information.
Indeed, the suggestion is that no “anonymized” and released big data set can be considered safe from re-identification — not without strict access controls.
‘Our results suggest that even heavily sampled anonymized datasets are unlikely to satisfy the modern standards for anonymization set forth by GDPR [Europe’s General Data Protection Regulation] and seriously challenge the technical and legal adequacy of the de-identification release-and-forget model,’ the researchers from Imperial College London and Belgium’s Université Catholique de Louvain write in the abstract to their paper, which has been published in the journal Nature Communications.
It’s of course by no means the first time data anonymization has been shown to be reversible. One of the researchers behind the paper, Imperial College’s Yves-Alexandre de Montjoye, has demonstrated in previous studies looking at credit card metadata that just four random pieces of information were enough to re-identify 90% of the shoppers as unique individuals, for example.
In another study, which de Montjoye co-authored, that investigated the privacy erosion of smartphone location data, researchers were able to uniquely identify 95% of the individuals in a data set with just four spatio-temporal points.
At the same time, despite such studies that show how easy it can be to pick individuals out of a data soup, “anonymized” consumer data sets such as those traded by brokers for marketing purposes can contain orders of magnitude more attributes per person.
The researchers cite data broker Experian selling Alteryx access to a de-identified data set containing 248 attributes per household for 120 million Americans, for example.
By their models’ measure, essentially none of those households are safe from being re-identified. Yet massive data sets continue being traded, greased with the emollient claim of ‘anonymity’ “
Read the full TechCrunch article here.
The distributed digital IDs combined with self-sovereign identity principles benefit all participants including the user, the organization that wants to authenticate the user, and those organizations that can verify the various claims a user makes about themselves. This is a long term effort, but the idea has already been embraced by IBM, Microsoft, Mastercard, and others and implemented by the province of British Columbia in its Verifiable Organizations Network (VON).
However, even when the individual agrees to release data for analysis, that data should be synthesized as described in this MIT News article. That is, the large dataset that contains any personal data should replace the real data with counterfeit data generated by a machine learning process that assures the counterfeit data remains statistically valid for the research being conducted. At that point all actual personal data can be scrubbed. Companies have already converted this science into practical products.
The latest research on data re-identification serves as another reminder that anonymization alone is no longer enough to safeguard personal information. As datasets become richer and analytical techniques become more sophisticated, organizations must move beyond “release and forget” privacy models toward solutions that minimize the exposure of real consumer data from the outset.
Combining self-sovereign identity with synthetic data offers a more resilient privacy strategy. By allowing consumers to control access to their information while replacing sensitive datasets with statistically accurate synthetic alternatives, organizations can continue extracting valuable insights without unnecessarily increasing privacy risks. As data protection regulations continue to evolve, these technologies are likely to play an increasingly important role in responsible data governance.
Overview by Tim Sloane, VP, Payments Innovation at Mercator Advisory Group
