Estimating the success of re-identifications in incomplete datasets using generative models

Abstract

While rich medical, behavioral, and socio-demographic data are key to modern data-driven research, their collection and use raise legitimate privacy concerns. Anonymizing datasets through de-identification and sampling before sharing them has been the main tool used to address those concerns. We here propose a generative copula-based method that can accurately estimate the likelihood of a specific person to be correctly re-identified, even in a heavily incomplete dataset. On 210 populations, our method obtains AUC scores for predicting individual uniqueness ranging from 0.84 to 0.97, with low false-discovery rate. Using our model, we find that 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes. Our results suggest that even heavily sampled anonymized datasets are unlikely to satisfy the modern standards for anonymization set forth by GDPR and seriously challenge the technical and legal adequacy of the de-identification release-and-forget model.

Five models for child and adolescent data linkage in the UK: a review of existing and proposed methods

“…Some data scientists have demonstrated that re-identification is highly probable in large datasets and suggest further technical solutions. 46 Rather than relying too heavily on de-identification, data protection must rely on a balance of information security and IG safeguards.…”

Developments in Privacy and Data Ownership in Mobile Health Technologies, 2016-2019

“…More recently, she demonstrated the ability to correctly identify 25% of research participants by name and 28% by address from data redacted beyond the HIPAA Safe Harbor standard [99]. Other authors have demonstrated the ability to re-identify at least 90% of Americans utilizing credit card metadata or via statistical models [96,100,101]. Given this emerging area of research, the need to systemically identify all stakeholders and potential data "owners" becomes increasingly essential in the identification of potential downstream security risks to users.…”

Genomic data sharing in Europe is stumbling—Could a code of conduct prevent its fall?

“…Pseudonymization has its limitations (Gymrek et al , ; cf. Glossary ), and developments in machine learning and artificial intelligence already allow re‐identification of even small samples from anonymized data sets (Rocher et al , ). The likelihood of individual re‐identification from genomic data, whether coded or anonymized, is higher when such data have been linked with familial, sociodemographic, or audio‐visual information, as is often the case in rare diseases research (Thu Nguyen et al , ).…”