Data anonymization
Changing a dataset so nobody in it can be identified, while keeping it useful.
Data anonymization means transforming personal data so that the people behind it can no longer be identified, by anyone, with reasonable effort. A hospital that wants to share patient records with researchers, or a city that publishes taxi trips, has to do this first. Done right, the data still answers useful questions, such as how many people in their forties had a given illness, without pointing at anyone.
Deleting names is not enough. In a well-known 2000 study, Latanya Sweeney estimated that roughly 87% of people in the United States could be singled out by just ZIP code, gender and birth date. So real anonymization also generalizes values (an age range instead of a birth date, a region instead of a street), drops rare combinations, or adds noise, as differential privacy does.
It is easy to confuse with pseudonymization, which swaps names for codes but keeps a key somewhere to link them back. Under the GDPR, pseudonymized data is still personal data; only truly anonymous data falls outside the law. Several famous cases, like the Netflix Prize dataset in 2006, showed that data released as anonymous could be re-identified by matching it with other public information.
Keep in mind
- Removing names is not enough; combinations like ZIP, gender and birth date can identify people.
- Common techniques: removal, generalization, suppression of rare cases, added noise.
- Pseudonymized data can be linked back, so the GDPR still treats it as personal data.
- There is always a trade-off between privacy and how useful the data stays.
Go deeper
- Data anonymization on Wikipedia
- GDPR Recital 26: not applicable to anonymous data
- Pseudonymization on Wikipedia
