Re-identifying De-identified Data — Who Can Find a House Once the Nameplate Is Gone?

"We process records so that individuals cannot be identified, then use them for research"

At the end of a hospital consent form or a health checkup notice, this sentence often appears. It is a sentence stating that medical records may be used for research after being processed so that individuals cannot be recognized. App terms also have a passage stating that usage history with names and contact information erased is used for statistics and service improvement. Readers usually feel reassured. This is because if your name is not on the record, it seems like no one will know that the record is you.

That processing mentioned in the notice has a name. De-identification is a process that deletes or alters items that allow people to be identified, such as names and contact information, from records, making it difficult to link those records back to a person. "Personal Data and Anonymization — Erase the Name, and the Person Remains" separates pseudonymization (processing that allows records to be linked again if separate additional information is kept) and anonymization (processing aimed at making it impossible to find out ever again), but in practice, both are commonly called by this single name. Where to draw the line to be recognized as "unidentifiable" is the point of contention in this article.

There is a reason to trust this processing. Items that directly point to a person are usually names, ID numbers, and phone numbers, and once those are deleted, what remains are common values like age, gender, diagnosis names, and test results. Laws have also drawn a similar line. A 2011 literature review noted that in most jurisdictions, privacy laws allow de-identified health data to be released for secondary purposes such as research without patient consent (DOI: 10.1371/journal.pone.0028071). The U.S. health information law HIPAA places health data that has undergone de-identification outside the regulations of that law, allowing it to be used for any purpose (PMID 22735615).

Thus, the widely spread belief can be written like this. If you delete items like names, that data is anonymous. The opposing claim also actually exists. The same literature review summarizes that several papers from the fields of medicine, law, and computer science have argued that de-identification can be easily reversed, so protection is not sufficient (DOI: 10.1371/journal.pone.0028071).

This article follows the ground between the two claims. The evidence is mostly medical data research from the United States, Canada, and Europe, and genomics and location records appear together. As you follow along, the question changes. It is about who holds more of what data, and how easily they can link it.

Three Items Are Almost One Person

Estimated using demographic data randomly sampled from 25% of the population of Montreal, Canada, nearly 98% of residents were unique using just three items: the full postal code, date of birth, and gender (PMID 21696636). Uniqueness is a state where the combination of a few items points to one and only one person. The Montreal figure is an estimate of that "one and only person" among the entire Montreal population, based on the 25% sample. The authors noted that these three items effectively act like a name for Montreal residents. Even if the name is erased, if these three boxes remain, that record is narrowed down to almost always belonging to a single person.

These three items are quasi-identifiers. They are pieces of information that do not reveal who someone is on their own, but can point to a single person when a few are gathered. The same study also showed that coarsening the values lowers the risk. For a single point in time, when reduced to about the first three digits of the postal code, gender, and birth year and month, the risk was sufficiently low. Data spanning multiple years had higher uniqueness, requiring values to be lumped together more broadly to bring the risk down to the same level (PMID 21696636).

Combinations that point to people are not found only in demographic items. In de-identified electronic health records, looking solely at which tests were prescribed was enough for the average patient to be distinguished from all other patients in 98.4% of cases (PMID 30864342). Wrist-worn motion sensors point to people down a slightly different path. A model trained on records from 353 people wearing them in daily life for 10 weeks had an average 96% risk of re-identifying the same person given just one day's worth of data (PMID 36883116). A discrimination system trained on public large-scale chest X-ray data accurately matched whether two images belonged to the same person with 95.55% accuracy, even when the photos were taken more than 10 years apart (DOI: 10.1038/s41598-022-19045-3). This is a different step from figuring out a name from a photograph. The authors nevertheless noted that an attacker could cross-reference the images with other data to obtain more information. Location records are the same. In movement records of 1.5 million people logged at an hourly resolution down to cell tower coverage areas, 95% were singled out as one person using just four space-time points (DOI: 10.1038/srep01376).

Even after erasing names, records derived from our bodies and daily lives narrow most people down to a single individual or allow them to be recognized as the same person.

What Is Needed After a Record Is Narrowed Down to One Person

The preceding figures show that a record is narrowed down to a single person. To figure out who that exact person is, one more thing is needed. The authors of the lab record study noted that their results do not mean an individual can be identified from lab records alone. Re-identification happens only if an attacker holds a separate lab record with a name attached from the start (PMID 30864342). In this study, the rate at which a patient was singled out from among 99 others using only the lab prescriptions from a single visit day was at least 25%.

This method of matching against another named dataset is a linkage attack, which is a method of finding the owner of a record by matching an anonymized dataset and another named dataset using items present in both. In this attack of matching against public or semi-public registries, uniqueness is a common yardstick for measuring re-identification risk (PMID 22776564).

In research data, this criterion of "being the only one" splits into two. Research data for export are often a sample of the entire population, so a combination that is unique within that dataset can have multiple matches in the outside society. Population uniqueness is a state where the person with that combination is the only one in the entire society outside the dataset as well. When calculated using surgical patient data from the state of Texas in the U.S., the probability that a randomly chosen patient's record matched a single record in external data across the state was 42.8% (PMID 27172145). The authors noted that this figure is an unacceptably high risk, and an underestimated value for states with smaller populations. This value was calculated regarding the practice of uploading data from small clinical trials as paper appendices.

Where are the datasets for matching actually located? Sources that researchers have evaluated as attack scenarios include voter registries and social media posts (PMID 33448306). Online health forums also serve as such sources. When a conference paper conducted a proof-of-concept attack using data from two health forums, 347 out of 2,805 forum users were linked to real people, and most of the re-identified users had their full names, dates of birth, phone numbers, and even health information exposed (DOI: 10.1109/icde48307.2020.00143).

In genomics, the matching data is human DNA itself. A beacon is a genomic sharing server that answers only yes or no to the question of whether a person with a specific letter at a specific DNA site is in the dataset. Because it only returns yes or no, it seemed safe, but in a mock beacon containing 1,000 people, 5,000 queries could determine whether a specific individual was in it. Even in a beacon actually in operation, 1,000 queries revealed the presence of a participant in a public genomics project (PMID 26522470). Beacons could expose participation facts and trait information inferred from them. This attack holds when the attacker already holds the person's genome and the beacon is relatively small (PMID 28339683).

A unique record is found when there is a named matching dataset, and how easily that dataset can be obtained determines the risk.

The Scorecard of Real Attacks

How successful are attacks actually when there is matching data to compare against? A systematic literature review of 14 re-identification attacks known up to 2011 found that, on average, roughly a quarter of records were found again, and the uncertainty of the estimate was large (DOI: 10.1371/journal.pone.0028071). However, there were only 2 cases out of 14 that attacked data de-identified according to existing standards, and the success rate for one of those targeting health data was 0.00013. The authors wrote that while the known evidence shows high re-identification rates, most are small studies and data not processed according to standards, leaving insufficient evidence to conclude the effectiveness of de-identification methods.

What is frequently cited as a de-identification standard is the method of U.S. HIPAA. HIPAA provides two paths to be recognized as de-identified. One is the path of showing through a formal model that the re-identification risk is small for the anticipated recipient. The other is Safe Harbor (PMID 25911674). Safe Harbor is HIPAA's method of setting items to delete or modify in a list, and recognizing data as de-identified if processed according to that list. It is a method like changing dates to years. Because it is easy to understand it is widely used, but it cannot adjust protection to suit the recipient's capability.

Calculated with population data from various U.S. states, the population in Safe Harbor-processed synthetic data that was unique and could be re-identified ranged from 0.01% to 0.25% by state (DOI: 10.1136/jamia.2009.000026). This value assumes the attacker knows all patient identification items. Assuming attackers used actual voter registries, the percentage dropped in many states, and was 0% in some states. This is because the availability of voter registries varies by state. The cost to re-identify a single person also ranged from $0 to $17,000. The authors concluded that blanket rules like Safe Harbor leave varying degrees of risk across institutions, and wrote that this serves as a basis to separately estimate risk on the spot before releasing data.

The same study also measured and compared cases that were not de-identified data. A "Limited Data Set" is data still regulated by the law, handed over under a use agreement with only direct identifiers removed, separate from the two paths recognized as de-identified by HIPAA. In this data, the population that was unique and could be re-identified ranged from 10% to 60% by state (DOI: 10.1136/jamia.2009.000026).

There are also items that the list misses. Even in medical records processed according to Safe Harbor, records noting traffic accidents had a re-identification risk 537 times higher compared to the general population due to the accident location, an item outside the list (PMID 30815177). How many people were actually found is not included in this value, which only measured by how many multiples the risk grows. The authors recommended that information on accident locations should be removed if it is a major accident that led to permanent disability, hospitalization, or death.

There are also public cases where risk was measured separately beyond standards. Releasing insurance claims data for an international competition to predict the next year's days of hospitalization, the research team that de-identified the data posited three plausible attacks and evaluated the risk. Their estimated re-identification probability was 0.0084, which was lower than the threshold of 0.05 set by the data-processing research team for the competition, and did not shake significantly even when initial assumptions were violated (PMID 22370452). Both the probability and the standard are values set and measured by the processing party.

The phenomenon where risk decreases when assuming the data attackers will actually hold also appeared in hospital data. In data of over 1 million patients from a U.S. university hospital, the median re-identification risk under the worst-case assumption that an attacker knows all items was 0.987 (with 1 being the most risky). Assuming attackers used voter registries, the risk dropped by a median of 90.1%, and assuming they used social media posts, it dropped by a median of 100% (PMID 33448306). This means the risk disappeared for more than half the people, but does not mean everyone's risk became 0. The authors concluded that re-identification risk varies depending on the context, and that appropriately assuming attackers could allow biomedical data to be shared more broadly than now. A 2013 workshop summary article noted that while published evidence of data properly de-identified according to HIPAA standards being re-identified is scarce, worries are growing (PMID 22735615).

While evidence of data processed according to standards being breached in real attacks is rare, the risk left behind by those standards varies by data and location.

A Single Rare Disease Patient's Record

People with rare diseases struggle to find both medical advice and emotional support at the same time. That is why many patient community boards have sprung up on hospital websites, social media, and foundation sites (PMID 32867839). A patient writes their story there. Age, sex, marital status, region of residence, and diagnosed disease naturally find their way into the text.

Suppose that the same patient's medical record is processed according to Safe Harbor rules and released for research. Name and address are removed, but marital status, the first three digits of the ZIP code, age, and sex commonly remain in records processed this way. The diagnosis name remains, too. After collecting these items from the posts, social media, and public records of 80 patients with eight rare diseases, researchers estimated how many people in the United States would share that exact combination. Based on that estimation, nearly 75% of the patients faced a high risk of being re-identified within the medical dataset containing them (PMID 32867839).

The danger in this scene comes from the fact that bulletin board posts make those items easy-to-obtain information. The authors wrote that such information paves the way for a motivated attacker. A motivated attacker is an attacker who has a reason to find a specific person or record, and intentionally gathers and matches scattered public information. Such an attacker can combine the patient's item combination and disease name to track down the record inside the anonymous data. The 75% is the proportion of "high risk" derived from the estimate that few people share the same combination, and differs from the proportion of people actually found. The authors considered that modifying community guidelines slightly and raising institutional protections together could reduce this risk, and proposed treating some dangerous diagnostic codes as quasi-identifiers as a task for future research.

For this risk to lead to actual harm, someone has to go to that trouble. Past re-identification research focused on how attacks could be carried out, and paid less attention to the likelihood that they would actually happen (PMID 25807380). One game theory study made the assumption that the recipient only attempts re-identification when the gain from doing so is greater than the cost incurred. When applied to actual cases, it was possible to share an amount of data close to the optimal solution that allowed a little risk while ensuring the recipient gained no benefit from re-identification, and that amount was much larger than Safe Harbor (PMID 25807380). This conclusion rests upon that assumption.

Researchers are also compiling lists of who is targeting whom and why. One workshop grouped potential re-identification attackers into six types according to their motives, and connected each type to six categories of harm (PMID 39176596).

Even for the exact same record, the risk varies greatly depending on who is targeting it with what public information in hand.

Measuring Risk Before Release

If risk changes depending on the conditions, you can calculate it under those conditions before releasing the data. Reidentification risk estimation is the task of calculating in advance how many people could be found again if someone matches the data against external data before it is released. One framework proposed for research data derived from health records goes through three steps: finding items that overlap with external data, finding small groups where the combination of those items applies to only one or two people, and assessing how many people are contained in both the research data and the external data (PMID 30972355). When this framework was applied to a large dataset for predicting suicidal behavior, the resulting countermeasures were removing medical institution identifiers that indirectly reveal the state of residence and removing the year of visit.

Calculation is not always easy. Population uniqueness usually cannot be measured directly and must be estimated. When estimation methods were tested using various clinical datasets, no single method worked well under all conditions. The researchers created rules for choosing different methods depending on the conditions (PMID 22776564). A method using synthetic versions of population data for estimation also emerged, and when two types of estimates were averaged, the median error in simulations was below 0.05 (PMID 35714132).

Measuring risk according to the context can also prevent data from being damaged unnecessarily. When biomedical data was processed using risk models that assumed different attacker goals and background knowledge, the information lost—relative to 100% for the original data—could be reduced by up to 10% when blocking a strong attacker and up to 24% when blocking a weak attacker (PMID 27322502). When rule-based de-identification policies were explored using population data from 10 U.S. states to yield an average of 5,000 candidate bundles, 2% of them carried lower risk than Safe Harbor while offering greater utility (PMID 25911674).

There are also mechanisms outside of calculation. In the United Kingdom, researchers use data within a secure data environment operated under the principle of the "Five Safes." One review concluded that placing de-identified medical record texts in such an environment results in a very low risk of patients being reidentified, and the authors therefore argued that such data should be opened up more for research (PMID 40978336). A review from Germany proposed the same principle as a countermeasure, noting that in practice, the possibility of reidentification is often underestimated (PMID 38231225). A legal paper discussing Brazil's public COVID-19 data similarly argued that de-identification alone is not enough, and that institutional mechanisms such as access controls and privacy impact assessments must go along with it (DOI: 10.1093/idpl/ipaa025).

Whether something is anonymous is not determined by the data alone; the processing method, the recipient, and the door through which the data is kept determine it together.

Where the Same Evidence Leads to Different Conclusions

"Anonymization is easily cracked" and "Actual risk is exaggerated" diverge even when reading the same literature. The points of divergence are largely five.

The first is what was measured. 98% and 95% are the proportions of feature combinations that point to a single person. 96% is the proportion of times the learned model re-identified the same person. 0.00013 is the proportion of success for a single attack targeting data processed according to a standard, while 0.987 is the risk of a model assuming the worst-case attacker. These four kinds of numbers answer different questions.

The second is how the attacker is assumed. One study on genomic data sharing viewed that past re-identification attacks focused on the worst-case scenario, creating a sharing practice that unnecessarily blocks research. As an alternative, it designed protection tailored to a recipient with reasonable resources instead of an attacker with limitless means, and applied it to genomic summary data from over 8,000 people (PMID 28065469). The other side also has its reasons. Because assuming a narrow background knowledge for the attacker binds the risk assessment to that assumption, a conference paper proposed a method of testing by assuming an attacker with the maximum background knowledge. This is especially true when the level of protection is loosened for utility (DOI: 10.1109/pst.2015.7232951).

The third is the type of data. Most of the literature has dealt with tabular data. A legal paper examining the General Data Protection Regulation (GDPR) regarding data such as text and video found that while the risk-oriented approach is a more detailed test suited to the purpose of the GDPR, following the strict standards issued by a European advisory body makes anonymization virtually impossible as long as the original data remains (DOI: 10.1093/idpl/ipac008). In video, the effect of processing is partial. When performing a process on facial bone CT scans to erase only the soft tissue of the face, the proportion of correct matches for the same person by deep learning dropped from 85% to 64%, and the proportion of correct matches by human eyes dropped from 84% to 55%. This was data from facial bone fracture patients at a hospital, and the proportion of correct matches by human eyes was similar between ordinary people and plastic surgeons. The authors concluded that this process significantly lowered risk while losing almost none of the data's utility (PMID 41741849). Risk decreased, but it did not disappear.

The fourth is whether countermeasures work. One study on genomic beacons showed that hiding the presence of rare variants or placing an upper limit on the number of queries per user can effectively reduce risk (PMID 28339683). Another study introduced a new attack utilizing the fact that neighboring DNA letters are not mutually independent, and showed that countermeasures hiding some positions or capping query limits fail to protect participants. In a simulated beacon containing data from 65 Europeans, even when rare variants were hidden, 5 queries yielded 95% confidence (PMID 30052749). The latter study tested countermeasures against an attack it newly proposed, while the former study tested its countermeasures on a beacon built from public genomics project data. The effectiveness of a countermeasure speaks only to the attacks against which that countermeasure was tested.

The fifth is what standard it is compared against. Legal researchers wrote that the legal definition of anonymous data itself is uncertain. While the GDPR acknowledges that identification risk may remain even in anonymous data, some argue that no risk is acceptable. After reviewing the technology, the authors concluded that risk always remains even when using anonymization (DOI: 10.1093/idpl/ipz026). Then, under the standard that risk must be 0 to be considered anonymous, almost no data can become anonymous, and where the line is drawn determines the answer. Location and scale also shake the standard. The re-identification risk from mobile phone location data in Shenzhen, China, was distinctly different from values reported in Western regions (PMID 26469780). In an estimation matching Canadian Labour Force Survey data with public social media information, the risk was 12.5% in two less-populated provinces and 1.9% in the larger province of Manitoba (DOI: 10.1109/csp62567.2024.00010, conference presentation).

Differential privacy, which deliberately mixes noise into results so that outcomes are nearly identical whether an individual's data is present or not, is another path trying to answer this debate with mathematical guarantees, and its utility and cost are covered in "Differential Privacy in the U.S. Census — After the Belief That Totals Are Safe Fell Apart".

The two claims are reading the same figures as answers to different questions.

Significance — The Question That Remains After Erasing the Name

There is a range where results close to conventional wisdom appear. This is the case when tabular data is processed according to standards, risk is separately estimated before release, and a designated recipient is required to use it within a secure environment. Published evidence of data processed according to standards being breached by actual attacks was as rare as a single instance of health data attacks fitting this description in a literature review collecting attacks up to 2011 (DOI: 10.1371/journal.pone.0028071). A 2013 workshop summary article also noted that such evidence is sparse, but worries are growing (PMID 22735615). The conclusion that the risk in a secure environment is very low comes from a review covering British medical record articles (PMID 40978336), and one low-risk figure was measured by the data-processing side itself (PMID 22370452). Research that actually attempted to attack data meeting all four conditions is not within the evidence covered by this article.

There is also a range where conventional wisdom proves wrong. This is the case when someone can deliberately collect detailed records spanning multiple years, bodily records such as tests, sensors, images, and genomes, data made public for anyone to download, and data to match against, such as posts left on a bulletin board. In that case, erasing the name is merely a starting point.

The conclusion drawn by the 2011 literature review still blocks both directions. The known evidence shows high re-identification rates, but the vast majority of those were data not processed according to standards, and the evidence is insufficient to judge the effectiveness of de-identification methods (DOI: 10.1371/journal.pone.0028071). Neither "anonymization is meaningless" nor "erasing names alone is enough" stands on this evidence.

Whether a record with its name erased is anonymous is determined by who holds what additional data and how easily they can access that record.

What quasi-identifiers, re-identification, and linkage attacks are, and how processing methods like k-anonymity came to be, are explained from the beginning in "Personal Data and Anonymization — Erase the Name, and the Person Remains". Whether individuals can be exposed even when only totals are released, and how the method of mixing in noise trades off against statistical utility, are covered next in "Differential Privacy in the U.S. Census — After the Belief That Totals Are Safe Fell Apart".

Source Papers

• "A Systematic Review of Re-Identification Attacks on Health Data" (2011) — DOI: 10.1371/journal.pone.0028071 — 14 attacks, roughly a quarter re-identified on average (high uncertainty). 2 attacks on data processed per standards, health data success rate 0.00013 for 1. Evidence centers mostly on small-scale or non-standard data, preventing conclusions on de-identification efficacy.
• "Building public trust in uses of Health Insurance Portability and Accountability Act de-identified data." (2013) — PMID 22735615 — HIPAA de-identified data is outside regulation and usable for any purpose. Evidence of re-identification announcements for properly de-identified data is scant, but concerns are growing.
• "The re-identification risk of Canadians from longitudinal demographics." (2011) — PMID 21696636 — Estimated using a 25% sample of the Montreal population, nearly 98% unique by full postal code, date of birth, and sex. First three digits of postal code, sex, and date of birth yield sufficiently low risk for single-timepoint data; longitudinal data requires further generalization.
• "Evaluation of patient re-identification using laboratory test orders and mitigation via latent space variables." (2019) — PMID 30864342 — 731,850 EHRs, 98.4% unique based solely on test orders. Over 25% re-identified out of 100 with a single visit's prescriptions. However, re-identification requires named external testing data.
• "WristPrint: Characterizing User Re-identification Risks from Wrist-worn Accelerometry Data." (2021) — PMID 36883116 — Wrist-sensor data from 353 individuals over 10 weeks; sharing one day's worth yields an average 96% re-identification risk.
• "Deep learning-based patient re-identification is able to exploit the biometric nature of medical chest X-ray data" (2022) — DOI: 10.1038/s41598-022-19045-3 — 112,120 chest X-rays from 30,805 individuals, 95.55% accuracy in determining the same person, even from photos over 10 years old.
• "Unique in the Crowd: The privacy bounds of human mobility" (2013) — DOI: 10.1038/srep01376 — Mobility records of 1.5 million people over 15 months; 95% unique from four points at an hourly and cell-tower resolution.
• "Estimating the re-identification risk of clinical data sets." (2012) — PMID 22776564 — Uniqueness is a common risk metric in linkage attacks with public registries. Because it cannot be measured directly, it must be estimated, and decision rules were developed since no estimator fits all conditions.
• "The Risks to Patient Privacy from Publishing Data from Clinical Anesthesia Studies." (2016) — PMID 27172145 — Surgical patients in Texas, population uniqueness probability 42.8%. Underestimated in small states.
• "Enabling realistic health data re-identification risk assessment through adversarial modeling." (2021) — PMID 33448306 — Patient data for over 1 million people, median worst-case risk 0.987, reduced by 90.1% under voter registry assumption and 100% under social media post assumption. Risk is context-dependent.
• "De-Health: All Your Online Health Information Are Belong to Us" (2020) — DOI: 10.1109/icde48307.2020.00143 — Proof-of-concept attack linked 347 out of 2,805 health forum users to real people, mostly exposing names, dates of birth, and phone numbers.
• "Privacy Risks from Genomic Data-Sharing Beacons." (2015) — PMID 26522470 — Re-identification in 5,000 queries using a simulated beacon of 1,000 people, and participant presence detected in 1,000 queries using a real beacon. Exposes participation fact and implied trait information.
• "Addressing Beacon re-identification attacks: quantification and mitigation of privacy risks." (2017) — PMID 28339683 — Attacks hold under conditions of small beacons and an attacker holding whole genomes. Effectively reduces risk by masking rare variants and limiting query counts.
• "Re-identification of individuals in genomic data-sharing beacons via allele inference." (2019) — PMID 30052749 — A new attack exploiting inter-locus correlations, 95% confidence with 5 queries in a 65-person simulated beacon. Partial hiding and query caps fail.
• "R-U policy frontiers for health data de-identification." (2015) — PMID 25911674 — HIPAA two paths (formal risk model / item-list safe harbor). Explored 20,000 policies across 10 states; 2% of policy bundles have lower risk and greater utility than safe harbor.
• "Evaluating re-identification risks with respect to the HIPAA privacy rule" (2010) — DOI: 10.1136/jamia.2009.000026 — State-by-state uniquely re-identifiable population: 0.01–0.25% for safe harbor, 10–60% for limited data sets. Decreased under voter registry attack, 0% in some states. Cost 0–17,000 dollars. Blanket rules leave uneven residual risk.
• "Re-Identification Risk in HIPAA De-Identified Datasets: The MVA Attack." (2018) — PMID 30815177 — Relative risk of re-identification 537 via traffic accident location in safe-harbor-processed records. Recommends deleting location information for major accidents.
• "De-identification methods for open health data: the case of the Heritage Health Prize claims dataset." (2012) — PMID 22370452 — Evaluation by researchers who processed competition claims data, re-identification probability 0.0084 (below the 0.05 standard), robust to assumption violations.
• "Participation in patient support forums may put rare disease patient data at risk of re-identification." (2020) — PMID 32867839 — Estimated using forum info from 80 patients across 8 rare diseases, nearly 75% at high risk. Motivated attacker. Mitigated by adjusting participation guidelines and institutional safeguards.
• "A game theoretic framework for analyzing re-identification risk." (2015) — PMID 25807380 — Assumes attempts occur only when gains outweigh costs. Shares amount close to optimal even at 0 risk, far exceeding safe harbor.
• "Health Data Re-Identification: Assessing Adversaries and Potential Harms." (2024) — PMID 39176596 — Workshop of 13 researchers, mapping 28 proposals into six motivation types linked to six harms.
• "Assessing and Minimizing Re-identification Risk in Research Data Derived from Health Care Records." (2019) — PMID 30972355 — Risk evaluation via overlapping items, small bundles, and population overlap. Removed healthcare facility identifiers and visit years in suicidal behavior prediction data.
• "Measuring re-identification risk using a synthetic estimator to enable data sharing." (2022) — PMID 35714132 — Synthetic-population-based estimator, median error of two estimated means under 0.05.
• "The Importance of Context: Risk-based De-identification of Biomedical Data." (2016) — PMID 27322502 — Context-tailored processing via risk models reduces information loss by up to 10% for strong attackers and up to 24% for weak attackers.
• "What is the patient re-identification risk from using de-identified clinical free text data for health research?" (2025) — PMID 40978336 — De-identified clinical free-text data kept in a secure data environment (five safeties) carries very low re-identification risk.
• "[Re-identification potential of structured health data]." (2024) — PMID 38231225 — Re-identification potential is frequently underestimated in practice. Countermeasures based on five-safeties principles.
• "Open data on the COVID-19 pandemic: anonymisation as a technical solution for transparency, privacy, and data protection" (2021) — DOI: 10.1093/idpl/ipaa025 — Anonymization must be supplemented by organizational measures such as access controls, privacy policies, and impact assessments.
• "Expanding Access to Large-Scale Genomic Data While Promoting Privacy: A Game Theoretic Approach." (2017) — PMID 28065469 — Worst-case-centric attacks produced practices that unnecessarily block research. Rational-resource recipient-tailored protection, over 8,000 genomic summary datasets.
• "Disclosure risk assessment via record linkage by a maximum-knowledge attacker" (2015) — DOI: 10.1109/pst.2015.7232951 — Proposed a maximum-knowledge attacker model and linkage testing to overcome limitations of background knowledge assumptions.
• "The GDPR and unstructured data: is anonymization possible?" (2022) — DOI: 10.1093/idpl/ipac008 — Risk-based approach vs. strict approach of the advisory body (WP 216). Under strict criteria, anonymizing unstructured data is virtually impossible as long as raw data remains.
• "De-identification Strategy and Re-identification Risks for Facial Computed Tomography Images via Deep Learning." (2026) — PMID 41741849 — 3,206 facial CT scans, selective soft-tissue deletion reduced deep-learning re-identification from 85 to 64% and human identification from 84 to 55%.
• "They who must not be identified—distinguishing personal from non-personal data under the GDPR" (2020) — DOI: 10.1093/idpl/ipz026 — Legal definition of anonymous data is uncertain. The GDPR acknowledges residual risk, but some demand zero. Anonymization always leaves residual risk.
• "Re-Identification Risk versus Data Utility for Aggregated Mobility Research Using Mobile Phone Location Data." (2015) — PMID 26469780 — Re-identification risk of Shenzhen mobile phone location data differs markedly from Western reports (spatial heterogeneity).
• "Linkage Deanonymization Risks, Data-Matching and Privacy: A Case Study" (2024) — DOI: 10.1109/csp62567.2024.00010 — Canadian Labour Force Survey, estimated risk when linked to social media is 12.5%, 12.5%, and 1.9%. Risk is lower as population size increases.