Reconsidering Anonymization-Related Concepts and the Term “Identification” Against the Backdrop of the European Legal Framework

Abstract

Sharing data in biomedical contexts has become increasingly relevant, but privacy concerns set constraints for free sharing of individual-level data. Data protection law protects only data relating to an identifiable individual, whereas “anonymous” data are free to be used by everybody. Usage of many terms related to anonymization is often not consistent among different domains such as statistics and law. The crucial term “identification” seems especially hard to define, since its definition presupposes the existence of identifying characteristics, leading to some circularity. In this article, we present a discussion of important terms based on a legal perspective that it is outlined before we present issues related to the usage of terms such as unique “identifiers,” “quasi-identifiers,” and “sensitive attributes.” Based on these terms, we have tried to circumvent a circular definition for the term “identification” by making two decisions: first, deciding which (natural) identifier should stand for the individual; second, deciding how to recognize the individual. In addition, we provide an overview of anonymization techniques/methods for preventing re-identification. The discussion of basic notions related to anonymization shows that there is some work to be done in order to achieve a mutual understanding between legal and technical experts concerning some of these notions. Using a dialectical definition process in order to merge technical and legal perspectives on terms seems important for enhancing mutual understanding.

Use and Understanding of Anonymization and De-Identification in the Biomedical Literature: Scoping Review

“…Conflicting representations of de-identification and anonymization were uncovered (see Textbox 2). In some articles, the terms are used interchangeably to refer to the same concept [34-37], while in others they outline strictly different processes [13,19,28,38].…”

“…“The term ‘anonymization’ is not identical to ‘de-identification.’ De-identification is the removal of attributes known to increase the risk of identification, and this can be seen as a preliminary step for producing anonymous data. It requires, however, a further assessment as to whether the de-identification process achieves anonymization.” [38]…”

Legal and ethical framework for global health information and biospecimen exchange - an international perspective

“…However, anonymization terminates the ability to link records with new datasets or to re-contact participants. Further, some argue that complete anonymization is impossible as long as the original records still exist [2,50], leading to concerns over potential data misuse and compromised privacy. This work shows that transfer of anonymized data may also not be subject to less stringent regulation.…”

A Multiagent System for Dynamic Data Aggregation in Medical Research

“…Need for anonymization and sharing individual patient data have been extensively discussed by the research community [4, 13, 29–31]. Several models in the area of distributed privacy-preserving data publishing have already been proposed (i.e., pseudonymization [6, 7], secure multiparty computations [8], microaggregation [32], and cloning [10]).…”

“…However, those models significantly affect the quality and, therefore, the utility of data, since they do not take into account data availability, content, structure, and representation. The authors in [31] discuss the trade-off between privacy and utility of the data and the risks of breaking anonymity of the data. They state that the risk assessment has to be made for every single situation of data collection.…”