Functional anonymisation: Personal data and the data environment

Abstract

Anonymisation of personal data has a long history stemming from the expansion of the types of data products routinely provided by National Statistical Institutes. Variants on anonymisation have received serious criticism reinforced by much-publicised apparent failures. We argue that both the operators of such schemes and their critics have become confused by being overly focused on the properties of the data themselves. We claim that, far from being able to determine whether data are anonymous (and therefore non-personal) by looking at the data alone, any anonymisation technique worthy of the name must take account of not only the data but also their environment. This paper proposes an alternative formulation called functional anonymisation that focuses on the relationship between the data and the environment within which the data exist (their data environment). We provide a formulation for describing the relationship between the data and their environment that links the legal notion of personal data with the statistical notion of disclosure control. Anonymisation, properly conceived and effectively conducted, can be a critical part of the toolkit of the privacy-respecting data controller and the wider remit of providing accurate and usable data.

Privacy: Essentially Contested, a Family Resemblance Concept, or a Family of Conceptions?

“…Has anything happened that I care about? We locate descriptions of the data environment (Elliot et al 2018) at this level, as well as cybersecurity, which changes the privacy affordances of technology. We also find descriptions of privacy protective (or neglectful) behaviour here too.…”

Toward a Risk-Utility Data Governance Framework for Research Using Genomic and Phenotypic Data in Safe Havens: Multifaceted Review

“…Commonly used nonperturbative disclosure controls include suppression of variables or entire records, aggregation (such as age into bands), and masking (such as of clinic identifiers to protect professional reputation). Further methods include data perturbation (such as variable swapping between records), homomorphic encryption (a technique enabling computations on encrypted data), and other privacy-enhancing technologies [ 8 ]. Many of these are still in developmental stages and might not ultimately prove suitable for real-world application without reducing data utility.…”

Privacy of Clinical Research Subjects: An Integrative Literature Review

“…This duty comprises those legal and ethical obligations that arise through specific relationships between researchers and human subjects (Stiles & Petrila, 2011). Confidentiality is directly related to the collection, use, and storage of personal data (Elliot, Mackey, O’Hara, & Tudor, 2016). According to Emanuel and Wendler (2008), protecting confidentiality in clinical research is an ongoing process that includes securing databases, locking filing cabinets, coding specimens and data forms, and interviewing participants in private spaces where they cannot be overheard.…”