Practice and Challenges of (De-)Anonymisation for Data Sharing

Abstract

Personal data is a necessity in many fields for research and innovation purposes, and when such data is shared, the data controller carries the responsibility of protecting the privacy of the individuals contained in their dataset. The removal of direct identifiers, such as full name and address, is not enough to secure the privacy of individuals as shown by de-anonymisation methods in the scientific literature. Data controllers need to become aware of the risks of de-anonymisation and apply the appropriate anonymisation measures before sharing their datasets, in order to comply with privacy regulations. To address this need, we defined a procedure that makes data controllers aware of the de-anonymisation risks and helps them in deciding the anonymisation measures that need to be taken in order to comply with the General Data Protection Regulation (GDPR). We showcase this procedure with a customer relationship management (CRM) dataset provided by a telecommunications provider. Finally, we recount the challenges we identified during the definition of this procedure and by putting existing knowledge and tools into practice.

Preserving Location Privacy for Mobile Phones with Homomorphic Encryption: The False Position Protocol

“…Thereby, private sector organizations can be described as organizations with a majority of private ownership seeking to generate profit and not being owned or controlled by the government. However, existing literature in this field often focuses on examining a single or specific set of barriers, e.g., familiarity, risk, and trust in inter-organizational data sharing (Ibrahim & Nicolaou, 2011), governance challenges of inter-organizational value chains (Choi & Kröschel, 2015), challenges of (de-)anonymization for data sharing (Bampoulidis et al, 2020) or privacy concerns (Cichy et al, 2021), but without taking a holistic view of the barriers.…”

A survey on email visualisation research to address the conflict between privacy and access

“…Throughout the review of literature, including those works that were excluded from the meta-analysis (as described earlier), it became clear that a range of privacy management techniques have been employed and proposed with relation to email analysis. The efficacy of these techniques, however, seems highly dependent on the skill and knowledge of the person applying them and the contextual knowledge possessed by the user (Elliot et al 2018;Bampoulidis et al 2020). These methods were collated by their effect on data, to represent five broad types of processes that can be applied to data, each reflecting a different level of privacy consciousness.…”

“…Equally, however, the task can be poorly achieved, making the reconstruction of these aspects not only possible but likely. Another factor, one which cannot be accounted for in a standardised way is the skill and knowledge base of the user (Elliot et al 2018;Bampoulidis et al 2020). Even with the more effective applications of privacy protection, there is a risk that a user may be able to re-identify individuals and/or make inferences about groups from surrounding data points (Arbuckle and El Emam 2020).…”