De-identification

Removing or scrambling the details that point to a specific person, so data can be used without exposing who it is about.

A name, an email address, or an ID number is replaced with something that cannot be traced back to the person on its own.

Processing data so that its identifiers can no longer be directly attributed to a specific individual. An identifier is a detail such as a name, a contact detail, or an ID number that points to one person.

People use several related terms, and the differences matter:

• De-identification is the general practice of removing or transforming identifiers so records are harder or impossible to link to a person.
• Pseudonymization replaces identifiers with a code, and the key to reverse it is kept separately. Under the EU's GDPR, pseudonymized data is still personal data.
• Anonymization goes further, so that people are no longer identifiable by any means reasonably likely to be used. Data that meets that standard falls outside the GDPR.

Common techniques include:

1. Removing identifiers, such as dropping names and contact details.
2. Hashing or tokenizing, which replaces a value with a scrambled code.
3. Generalizing, such as using an age range in place of a birth date.
4. Adding noise, which blurs exact values.

Strength depends on whether the result can be reversed or linked. A simple hash of a common value can sometimes be guessed, so strong approaches use methods that cannot be reversed and that change from one use to the next.

De-identification sits next to terms that are easy to mix up:

• Data minimization limits how much data is collected, while de-identification changes what is done to data that exists.
• PII (Personally Identifiable Information) is the kind of information that de-identification targets.
• Secure multi-party computation protects data while it is used, and it can be paired with de-identification.