NIST SP 800-188 日本語訳

Simson Garfnkel Joseph Near Aref N. Dajani Phyllis Singer Barbara Guttman

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-188

Simson Garfinkel Barbara Guttman Software Quality Group Software and Systems Division

Software and Systems Division

Joseph Near

Department of Computer Science University of Vermont

Aref N. Dajani Phyllis Singer

Center for Enterprise Dissemination

US Census Bureau

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-188

September 2023

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identifed in this paper in order to specify the experimental procedure adequately. Such identifcation does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identifed are necessarily the best available for the purpose.

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.

This document is presented with the hope that its content may be of interest to the general privacy community. The views in this document are those of the authors, and do not represent those of the U.S. Census Bureau.

Authority This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal offcials exercising policy authority over such systems. This guideline is consistent with the requirements of the Offce of Management and Budget (OMB) Circular A-130.

Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal offcial. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

NIST Technical Series Policies Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifer Syntax

Publication History Approved by the NIST Editorial Review Board on 2023-09-07.

How to cite this NIST Technical Series Publication: Garfnkel S, Guttman B, Near J, Dajani AN, Singer P (2023) De-Identifying Government Datasets: Techniques and Governance. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-188. https://doi.org/10.6028/NIST.SP.800-188

Simson Garfinkel: 0000-0003-1294-2831

Joseph Near: 0000-0002-3203-3742

Aref N. Dajani: 0000-0003-0361-5409

Phyllis Singer: 0000-0002-8885-7273

sp800-188@nist.gov

National Institute of Standards and Technology Attn: Software and Systems Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8970) Gaithersburg, MD 20899-8970

All comments are subject to release under the Freedom of Information Act (FOIA).

De-identifcation is a general term for any process of removing the association between a set of identifying data and the data subject. This document describes the use of de-identifcation with the goal of preventing or limiting disclosure risks to individuals and establishments while still allowing for the production of meaningful statistical analysis. Government agencies can use de-identifcation to reduce the privacy risk associated with collecting, processing, archiving, distributing, or publishing government data. Previously, NIST IR 8053, De-Identifcation of Personal Information, provided a detailed survey of de-identifcation and re-identifcation techniques. This document provides specifc guidance to government agencies that wish to use de-identifcation. Before using de-identifcation, agencies should evaluate their goals for using de-identifcation and the potential risks that releasing de-identifed data might create. Agencies should decide upon a data-sharing model, such as publishing de-identifed data, publishing synthetic data based on identi-fed data, providing a query interface that incorporates de-identifcation, or sharing data in non-public protected enclaves. Agencies can create a Disclosure Review Board to over-see the process of de-identifcation. They can also adopt a de-identifcation standard with measurable performance levels and perform re-identifcation studies to gauge the risk asso-ciated with de-identifcation. Several specifc techniques for de-identifcation are available, including de-identifcation by removing identifers, transforming quasi-identifers, and gen-erating synthetic data using models. People who perform de-identifcation generally use special-purpose software tools to perform the data manipulation and calculate the likely risk of re-identifcation. However, not all tools that merely mask personal information pro-vide suffcient functionality for performing de-identifcation. This document also includes an extensive list of references, a glossary, and a list of specifc de-identifcation tools, which is only included to convey the range of tools currently available and is not intended to imply a recommendation or endorsement by NIST.

data life cycle; de-identification; differential privacy; direct identifiers; Disclosure Review Board; k-anonymity; privacy; pseudonymization; quasi-identifiers; re-identification; synthetic data; The Five Safes.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsi-bilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organiza-tions.

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL.

No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication.

The authors wish to thank the U.S. Census Bureau for its help in researching and preparing this publication, with specifc thanks to John Abowd, Ron Jarmin, Christa Jones, and Laura McKenna. The authors would also like to thank Luk Arbuckle, Andrew Baker, Paul Black, Daniel Barth-Jones, Christi Dant, Khaled El Emam, Robert Gellman, Tom Krenzke, Naomi Lefkovitz, Bradley Malin, Kevin Mangold, John Moehrke, Linda Sanchez, Denise Sturdy, and Chris Traver for providing comments on previous drafts and their valuable insights, all of which were helpful in creating this publication.

The authors also wish to thank several organizations that provided useful comments on previous drafts of this publication: Anonos (with comments from Odia Kagan Partner, Chair of GDPR Com-pliance and International Privacy, Fox Rothschild LLP); the Association for Computing Machinery’s U.S. Technology Policy Committee; the Defense Contract Management Agency (DCMA) Informa-tion Assurance Directorate; the Electronic Privacy Information Center; the Interagency Council on Statistical Policy/Federal Committee on Statistical Methodology (FCSM) Disclosure Review Board Community of Practice; the Offce of the Chief Privacy Offcer within the U.S. Department of Education; the Offce of Planning, Research, and Evaluation (OPRE) within the Administration for Children and Families at the U.S. Department of Health and Human Services; the Millennium Challenge Corporation (MCC) Department of Policy and Evaluation; Integrating the Healthcare Enterprise (IHE), an ANSI-accredited standards organization focused on healthcare standards; the Privacy Tools Project at Harvard University (including Micah Altman, Stephen Chong, Kobbi Nis-sim, David O’Brien, Salil Vadhan, and Alexandra Wood); Tumult Labs (Gerome Miklau and David Pujol); the United Health Group (Peter Dumont and Ying Zhu); and the U.S. Agency for Interna-tional Development Chief Data Offcer (Brandon Pustejovsky).

Simson Garfnkel: Conceptualization, Supervision, Writing (original draft preparation); Joseph Near: Writing (original draft preparation); Aref N. Dajani: Writing (original draft preparation of the section on re-identifcation studies); Phyllis Singer: Writing (original draft preparation of the section on re-identifcation studies); Barbara Guttman: Conceptualization, Supervision, Writing.

Every federal agency creates and maintains internal datasets that are vital for fulflling its mission. The Foundation for Evidence-based Policymaking Act of 2018 [2] and its Phase 1 implementation memorandum M-19-23 [168] mandate that agencies also collect and publish their government data in open, machine-readable formats when it is appropriate to do so. Agencies can use de-identifcation to make government datasets available while protecting the privacy of the individuals whose data are contained within those datasets.

The U.S. Government defnes personally identifable information (PII) as “information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specifc individual.”[4]

For decades, de-identifcation based on simply removing identifying information was thought to be suffcient to prevent the re-identifcation of individuals in large datasets. Since the mid 1990s, a growing body of research has demonstrated the reverse, resulting in new privacy attacks that are capable of re-identifying individuals in “de-identifed” data releases. For several years, the goals of such attacks appeared to be embarrassing the publishing agency and achieving academic distinction for the privacy researcher [65]. More recently, as high-resolution de-identifed geolocation data have become commercially available, re-identifcation techniques have been used by journalists, activists, and malicious actors [130, 170, 90] to learn information about individuals that was intended to be kept confdential. These attacks highlight the defciencies in traditional approaches to de-identifcation.

Formal models of privacy, like k-anonymity [151] and differential privacy [52], use mathematically rigorous approaches that are designed to allow for the controlled use of confdential data while minimizing the privacy loss suffered by the data subjects.¹ Because there is an inherent trade-off between the accuracy of published data and the amount of privacy protection afforded to data subjects, most formal methods have some kind of parameter that can be adjusted to control the “privacy cost” of a particular data release. Informally, a data release with a low privacy cost causes little additional privacy risk to the participants, while a higher privacy cost results in more privacy risk. When they are available and have suffcient functionality for the task at hand, formal privacy methods should be preferred over informal ad hoc methods.

Decisions and practices regarding the de-identifcation and release of government data can be integral to the mission and proper functioning of a government agency. As such, an agency’s leadership should manage these activities in a way that ensures performance and

Establishing a DRB may seem like an expensive and complicated administrative undertaking for some agencies. However, a properly constituted DRB and the development of consistent procedures regarding data release should enable agencies to lower the risks associated with each data release, which is likely to save agency resources in the long term. Agencies can create or adopt standards to guide those performing de-identifcation and regarding the accuracy of de-identifed data. If accuracy goals exist, then techniques such as differential privacy can be used to make the data suffciently accurate for the intended purpose but not unnecessarily more accurate, which can limit the amount of privacy loss. However, agencies must carefully choose and implement accuracy requirements. If data accuracy and privacy goals cannot be well-maintained, then releases of data that are not suffciently accurate can result in incorrect scientifc conclusions and policy decisions.

Agencies should consider performing de-identifcation with trained individuals using software specifcally designed for that purpose. While it is possible to perform de-identifcation with off-the-shelf software like a commercial spreadsheet or fnancial planning program, such programs typically lack the key functions required for sophisticated de-identifcation. As a result, they may encourage the use of simplistic de-identifcation methods, such as deleting columns that contain sensitive data categories and manually searching and removing individual data cells that appear sensitive.² This may result in a dataset that appears de-identifed but still contains signifcant disclosure risks.

Finally, different countries have different standards and policies regarding the defnition and use of de-identifed data. Information that is regarded as de-identifed in one jurisdiction may be regarded as being identifable in another. This may be especially relevant in the case of international scientifc collaborations and illustrates the need for agencies that perform de-identifcation to create mechanisms for data scientists, attorneys, and policymakers to coordinate on these topics.

The U.S. Government collects, maintains, and uses many kinds of datasets. Every federal agency creates and maintains internal datasets that are vital for fulflling its mission, such as delivering services to citizens or ensuring regulatory compliance. There are also 13 princi-pal federal statistical agencies, three recognized statistical units, and over 100 other federal statistical programs that collect, compile, process, analyze, and distribute information for statistical purposes [156, 121].

Government programs collect information from individuals and organizations for taxation, public benefts, public health, licensing, employment, censuses, and the production of of-fcial statistics. While privacy is integral, many individuals and organizations that provide information to the Government do not typically have the right to opt out of such requests. For example, people and establishments in the United States must respond to mandatory U.S. Census Bureau surveys.

Agencies make many of their datasets available to the public. The U.S. Government publishes data to promote commerce, scientifc research, and public transparency. Many datasets contain some data elements that should not be made public, and it is necessary to remove such information before making the rest of the dataset available. Some datasets are so sensitive that they cannot be made publicly available at all but can be available on a limited basis to qualifed, vetted researchers in protected enclaves. In some cases, agencies may also elect to release summary statistics of sensitive data or create synthetic datasets that resemble the original data but that have a lower disclosure risk [9, 99].

There is frequent tension between the goals of privacy protection and the release of use-ful data to the public. One way that the Government attempts to resolve this tension is with an offcial promise of confdentiality to individuals and organizations regarding the information that they provide [132]. Other information is created by the Government as a consequence of providing government services. This information – sometimes called administrative data – is also increasingly being used and made available for statistical pur-poses and must be protected.

A bedrock principle of offcial statistical programs is that data provided to the Government should generally remain confdential and not be used in a way that would pose a privacy or confdentiality risk to the individual or the organization providing the data. One justifcation for this principle is that it helps to ensure high data accuracy. If data providers believe that the information they provide will remain confdential, they may be willing to provide accurate information.

In 2018, the U.S. Congress passed three laws that signifcantly increased the need for ex-pertise regarding privacy-preserving data analysis and data publishing techniques, such as de-identifcation:

The Evidence Act contains specifc guidance requiring that agencies publishing data take into account “(A) risks and restrictions related to the disclosure of personally identifable information, including the risk that an individual data asset in isolation does not pose a privacy or confdentiality risk but when combined with other available information may pose such a risk;” and “(B) security considerations, including the risk that information in an individual data asset in isolation does not pose a security risk but when combined with other available information may pose such a risk” [2].

The Evidence Act incorporated and reauthorized The Confdential Information Protection and Statistical Effciency Act of 2002, now called the 2018 CIPSEA. Part B, “Confdential Information Protection,” provides for the legal protection of “data or information acquired by an agency under a pledge of confdentiality for ex-clusively statistical purposes shall not be disclosed by an agency in identifable form for any use other than an exclusively statistical purpose, except with the informed consent of the respondent.”

Finally, the 2018 CIPSEA promotes Offce of Management and Budget Statistical Policy Directive 1, “Fundamental Responsibilities of Federal Statistical Agencies and Recognized Statistical Units,”[100] to statute as 44 U.S. Code §§ 3561-4.”

Other laws, regulations, and policies that govern the release of statistics and data to the public enshrine this principle of confdentiality. For example:

Federal laws and regulations recognize that it is not possible to eliminate all privacy risk when deidentifying data. Guidance from the U.S. Department of Health and Human Services (HHS) on the Health Insurance Portability and Accountability Act (HIPAA) de-identification standards notes that “[b]oth methods [the Safe Harbor and expert determination methods for de-identification], even when properly applied, yield de-identified data that retains some risk of identification. Although the risk is very small, it is not zero, and there is a possibility that de-identified data could be linked back to the identity of the patient to which it corresponds” [166].

U.S. law also balances privacy risk with other factors, such as transparency, accountability, and the opportunity for public good. An example of this balance is the handling of personally identifiable information collected by the Census Bureau as part of the decennial census. This information remains confidential for 72 years and is then transferred to the National Archives and Records Administration, where it is released to the public [161, 5].

De-identification is “a general term for any process of removing the association between a set of identifying data and the data subject”[85]. This document describes the use of de-identification with the goal of preventing or limiting disclosure risks to individuals and establishments while still allowing for the production of aggregate statistics.³⁴ De-identification is not a single technique but a collection of approaches, algorithms, and tools that can be applied to different kinds of data with differing levels of effectiveness. In general, the potential risk to privacy posed by a dataset’s release decreases as increasingly manipulative de-identification techniques are employed, but data accuracy and – in some cases – the ultimate utility of the de-identified dataset decreases as well.

Accuracy is traditionally defined as the “closeness of computations or estimates to the exact or true values that the statistics were intended to measure” [71].⁵ The data accuracy of de-identified data, therefore, refers to the degree to which inferences drawn on the de-identified data will be consistent with inferences drawn on the original data. Data accuracy can be measured by the ratio of a value computed with de-identified data to the same value computed using the underlying true confidential value. Because there are many potential computations that may be performed with de-identified data, de-identified data that are accurate for one purpose may not be accurate for another. As accuracy decreases, statistical power may be lost, rendering some inferences no longer possible. Alternatively, new biases and errors may be introduced, resulting in incorrect inferences.

In economics, utility is traditionally defined as “the satisfaction derived from consumption of a good or service”[71]. Data utility, therefore, refers to the value that data users can derive from data in general. When speaking of de-identified data, utility comes from two public goods: the uses of the data and the privacy protection afforded by the de-identification process.

In general, data accuracy decreases as more aggressive de-identifcation techniques are employed. Therefore, any effort that involves the release of data that contain personal information typically involves making a trade-off between identifability and data accuracy. However, increased privacy protections do not necessarily result in decreased data utility for certain specifed purposes.

Some users of de-identified data may be able to use the data to make inferences regarding specific individuals or establishments by virtue of their inclusion in the dataset rather than on the basis of a statistical model based on the sampled population. Such users may even be able to re-identify the data subjects. Both of these uses undo the privacy goals of de-identification.

In general:

Planning is essential for successful de-identification and data release. In a research environment, this planning should include the research design, data collection, protection of identifiers, disclosure analysis, and data-sharing strategy. In an operational environment, this planning includes a comprehensive analysis of the purpose of the data release, the expected use of the released data, the privacy-related risks, and the privacy-protecting controls. Both cases should review the appropriateness of various privacy controls given the risks, intended uses, and the ways that those controls could fail. See Sec. 3.6, “Disclosure Review Boards” for a discussion of how a Disclosure Review Board (DRB) or an Institutional Review Board (IRB) can be used to make this process orderly, predictable, and repeatable.

De-identifcation can have signifcant time, labor, and data processing costs. However, when properly executed, this effort can result in data that have high value for a research community and the general public while still adequately protecting individual privacy.

This document provides guidance on the selection, use, and evaluation of de-identifcation techniques for U.S. Government datasets. It also provides a framework that can be adapted by federal agencies to shape the governance of de-identifcation processes. The ultimate goal of this document is to reduce disclosure risks that might result from an intentional data release. However, this document does not provide step-by-step guidance for de-identifying the vast range of possible datasets held by U.S. Government agencies. For each dataset that is to be de-identifed, agencies must rely on experts and have their proposed efforts reviewed by an appropriate governance procedure.

This document is intended for use by government system engineers, security officers, data scientists, privacy officers, disclosure review boards, and other officials. It is also designed to be generally informative to researchers and academics involved in the technical aspects of de-identifying government data. While this document assumes a high-level understanding of information system security technologies, it is intended to be accessible to a wide audience.

The remainder of this publication is organized as follows:

Following the conclusion is a list of all publications referenced in this document, as well as an appendix that includes standards, related NIST publications, other selected publications by the U.S. and other governments, reports, books, and articles of inter-est. A second appendix provides a list of symbols, abbreviations, and acronyms. The third appendix contains a glossary.

If the information derived from personal data remains in a de-identifed dataset, the dataset may inadvertently reveal attributes related to specifc individuals. When this happens, the privacy protection provided by de-identifcation is compromised. Even if a specifc individ-ual cannot be matched to a specifc data record, de-identifed data can be used to improve the accuracy of inferences regarding individuals whose de-identifed data are in the dataset. This so-called inference risk cannot be eliminated if there is any information in the de-identifed data, but it can be managed or reduced to an acceptable level. Thus, the decision of how or whether to de-identify data should be made in conjunction with decisions over how the de-identifed data will be used, shared, or released.

De-identifcation is especially important for government agencies, businesses, and other or-ganizations that seek to make data available to outsiders. For example, signifcant medical research is made possible through the sharing of de-identifed patient information under the framework established by the HIPAA Privacy Rule, which is the primary U.S. regulation that provides for the privacy of medical, billing, enrollment, payment, and claims records, as well as “other records that are used, in whole or in part, by or for the covered entity to make decisions about individuals” [119]. The HIPAA Privacy Rule de-identifcation framework applies to both government organizations charged with protecting government datasets and to private-sector organizations, such as health plans and health care providers.

Agencies may also be required to de-identify records when responding to a Freedom of Information Act (FOIA) [164, 163] request in a manner that is consistent with Exemption 6, which protects information about individuals in “personnel and medical fles and similar fles” when the disclosure of such information “would constitute a clearly unwarranted in-vasion of personal privacy,” and Exemption 7(C), which is limited to information compiled for law enforcement purposes and protects personal information when disclosure “could reasonably be expected to constitute an unwarranted invasion of personal privacy.” The meaning of these exemptions has been clarifed by multiple cases before the U.S. Supreme Court [134, 145, 146]. However, agencies should consider the cumulative privacy impact of multiple FOIA requests and potential releases, as previous releases may be combined with future releases to learn information about individuals that the agency had previously attempted to protect from public release.

The modern practice of de-identifcation can be broken down into three distinct phases:

This does not mean that algorithms that implement differential privacy eliminate all privacy risk. Rather, it means that the amount of privacy risk that results from the use of these algorithms can be mathematically bounded. These mathematical limits on privacy risk have created considerable interest in differential privacy in academia, commerce, and business.

During the first decade of the 21st century, there was a growing awareness within the U.S. Government about the risks that could result from the improper handling and inadvertent release of personal identifying and financial information. This realization, combined with a growing number of inadvertent data disclosures within the U.S. Government, resulted in President George W. Bush signing Executive Order 13402, which established an Identity Theft Task Force on May 10, 2006 [25]. One year later, the Office of Management and Budget (OMB) issued Memorandum M-07-16 [80], which required federal agencies to develop and implement breach notification policies. As part of this effort, NIST issued Special Publication (SP) 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) [103]. These policies and documents had the specific goal of limiting the accessibility of information that could be directly used for identity theft but did not create a framework for processing government datasets so that they could be released without impacting the privacy of the data subjects.

In 2015, NIST published NIST Interagency or Internal Report (IR) 8053, De-Identifcation of Personal Information [66], which provided an overview of de-identifcation issues and terminology. It also summarized signifcant publications involving de-identifcation and re-identifcation. However, NIST IR 8053 did not make recommendations regarding the appropriateness of de-identifcation or specifc de-identifcation algorithms. The following year, NIST convened the Government Data De-Identifcation Stakeholder’s Meeting [67].

In 2016, OMB revised Circular A-130, “Managing Information as a Strategic Resource,” refecting changes in law and advances in technology. The revision was also designed to ensure consistency between executive orders, presidential directives, NIST standards and guidelines, and other OMB policies. A-130 defnes personally identifable information (PII) as “information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specifc individual.”[4]

De-identification is one of several models for allowing the controlled sharing of data derived from confidential data about individuals.¹⁰ Other models include the use of data processing enclaves, where computations are performed with confidential data using computers that are physically isolated from the outside world. That isolation might be performed with locked doors and guards, or it might be performed using silicon and encryption, as is the case with enclaves implemented on some modern microprocessors. Another approach is to use mathematical techniques, such as secure multi-party computation, so that computations can be carried out on confidential data held by multiple parties without ever bringing all of the confidential data together in a single location. Researchers have introduced more than 80 different privacy metrics in an attempt to characterize privacy and privacy loss in different settings [169].

Techniques for privacy-preserving data-sharing and analysis can be layered to provide stronger protection than any single technique would provide in isolation. Such complementary models are discussed in Sec. 3.4. For a more complete description of data-sharing models, privacy-preserving data publishing, and privacy-preserving data mining, see NIST IR 8053.

Many of the techniques discussed in this publication (e.g., fully synthetic data and differential privacy) currently have limited use within the Federal Government due to cost, time constraints, and the sophistication required of practitioners. However, these techniques are likely to see increased use as agencies seek to make datasets that include identifying information available.

While each of the de-identification traditions has developed its own terminology and mathematical models, they share many underlying goals and concepts. Where terminology differs, this document relies on the terminology developed in previous documents by the U.S. Government and standards organizations. This document uses the terms privacy risk and informational risk to refer in aggregate to various types of disclosure risk, as defined later in this section.

De-identification is a “general term for any process of removing the association between a set of identifying data and the data subject” [85]. This document is specifically concerned with de-identification techniques that have the goal of preventing or limiting disclosure risks to individuals and establishments while still allowing for the production of aggregate statistics. As a result, this document devotes attention to noise-introducing techniques, such as differential privacy and the creation of synthetic datasets that are based on privacy-preserving models. De-identification takes an original dataset and produces de-identified data. This document uses the term dataset to refer to the collected data and assumes that data collection is completed before de-identification begins. However, many of the processes and techniques described are also applicable in other collection models (e.g., streaming data).

Re-identification is the “process by which information is attributed to de-identified data in order to identify the individual to whom the de-identified data relate”[117]. This definition is from the Organization for Economic Cooperation and Development (OECD) Legal Instruments Recommendation of the Council on Health Data Governance (2016).

Re-identification risk is the likelihood that a third party can re-identify data subjects in a de-identified dataset. Re-identification risk is typically a function of the adverse impacts that would arise if re-identification were to occur and the likelihood of occurrence. Re-identification risk is a specific form of privacy risk that can result from the release or use of de-identified data.

Redaction is the removal of information from a document or dataset for legal or security purposes. Also known as suppression, redaction is a kind of de-identifying technique that relies on the removal of information. In general, redaction alone is insuffcient to provide formal privacy guarantees, such as differential privacy. Redaction may also reduce the accuracy of the dataset since the use of selective redaction may result in the introduction of non-ignorable bias.

Anonymization is a “process that removes the association between the identifying dataset and the data subject” [85]. This term is reserved for de-identifcaiton processes that cannot be reversed.

Some authors use the terms de-identification and anonymization interchangeably. In some contexts, the term anonymization is used to describe the destruction of a table that maps pseudonyms to real identifiers.¹¹ Both of these uses are potentially misleading, as many de-identification procedures can be readily reversed if a dataset is discovered that maps a unique attribute or combination of attributes to identities. For example, a medical dataset may contain a list of names, medical identifiers, the rooms where a patient was seen, the time that the patient was seen, and the results of a medical test. Such a dataset could be de-identified by removing the name and medical identification numbers. However, the dataset of medical test results should not be considered anonymized because the tests can be re-identified if the dataset is joined with a second dataset of room numbers, times, and names. Since it is not possible to know whether such an auxiliary dataset exists, this publication recommends avoiding the word anonymization and using the word de-identification instead. Because of the inconsistencies in the use and definitions of the word “anonymization,” this document avoids the term except in this section and in the titles of some references.

Pseudonymization is a “particular type of [de-identification]¹² that both removes the association with a data subject and adds an association between a particular set of characteristics relating to the data subject and one or more pseudonyms” [85]. The term coded is frequently used in healthcare settings to describe data that have been pseudonymized. Pseudonymization is commonly used so that multiple observations of an individual over time can be matched and so that an individual can be re-identified if there is a policy reason to do so. Although pseudonymous data are typically re-identified by consulting a key that may be highly protected, the existence of the pseudonym identifiers frequently increases the risk of re-identification through other means.

Non-public personal information is used to describe personal information that is in a dataset that is not publicly available. Non-public personal information is not necessarily identifying.

The definition of identifying information above suggests that it is easy – or at least possible – to distinguish personal information from identifying information. However, many techniques for de-identification require an expert to make this distinction and protect only the identifying information. Indeed, as understanding of privacy risk develops, it is increasingly apparent that all information is potentially identifying information, and it is necessary to thoughtfully engage in prioritizing the concerns of balancing privacy threats with scientific data accuracy.

This document envisions a de-identification process in which an original dataset that contains personal information is algorithmically processed to produce de-identified data. The result may be a de-identified dataset; aggregate statistics, such as summary tables; or a synthetic dataset in which the data are created by a model. This kind of de-identification is envisioned as a batch process. Alternatively, the de-identification process may be a system that accepts queries and returns responses that do not leak more identifying information than is allowable by policy. De-identified results may be corrected or updated and re-released on a periodic basis. The accumulated leakage of information from multiple releases may be significant, even if the leakage from a single release is small. Issues that arise from multiple releases are discussed in Sec. 3.4, “Data-Sharing Models.”

Disclosure is generally the exposure of data beyond the original collection use case. According to the traditional SDL literature,

“Disclosure relates to inappropriate attribution of information to a data subject, whether an individual or an organization. Disclosure occurs when a data subject is identified from a released file (identity disclosure), sensitive information about a data subject is revealed through the released file (attribute disclosure), or the released data substantially make it possible to determine the value of some characteristic of an individual more accurately than otherwise would have been possible (inferential disclosure).” [132, p. 23–24, emphasis in original]

A similar defnition appears in the Glossary of Statistical Terms:

Disclosure

Disclosure relates to the inappropriate attribution of information to a data subject, whether an individual or an organisation. Disclosure has two components: identification and attribution. [71]

This traditional definition for disclosure can be ambiguous and can produce incorrect conclusions. An alternative formulation in plain language is that a confidentiality breach occurs when an inference about the attribute associated with a particular entity is improved through the use of that entity’s data in producing the statistical output. Privacy-eroding inference in this manner is distinct from inferences that can be drawn independent of the entity’s data and through generalizable inference from the larger population.

The definitions from differential privacy are more nuanced than those from traditional SDL. They put a bound on the relative probability of disclosure by comparing when an individual is in the frame and out of the frame (either by removal or replacement from the frame) [49, 50]. Abowd and Hawes show how these privacy-preserving definitions relate to identity and attribute disclosures [7, p. 12].

According to Kifer et al., the “confdentiality-breaching versions of identity, attribute and inferential disclosure all have the same mathematical formulation” [88, p. 4]. Careful def-initions show that identity and attribute disclosure are merely high-confdence cases of inferential disclosure. Additional information about disclosure can be found in Sec. 3.1.

Disclosure limitation is a general term for the practice of allowing summary information or queries on data within a dataset to be released without revealing information about spe-cifc individuals whose personal information is contained within the dataset. Thus, de-identifcation is a kind of disclosure limitation technique. Every disclosure limitation pro-cess introduces inaccuracy into the results [14, 11].

A primary goal of disclosure limitation is to protect the privacy of individuals while avoid-ing the introduction of non-ignorable biases [8] (e.g., bias that might lead a social scientist to come to the wrong conclusion) into the de-identifed dataset. One way to measure the amount of bias that has been introduced by the de-identifcation process is to compare statistics or models generated by analyzing the original dataset with those that are gener-ated by analyzing the de-identifed datasets. Such biases introduced by the de-identifcation process are typically unrelated to any statistical biases that may also exist in the original data.

Formal models of privacy can quantify the privacy protection offered by a de-identifcation process. With methods based on differential privacy, this measurement takes the form of a number called privacy loss, which quantifes the additional risk that an adversary might learn something new about an individual as the result of a de-identifed data release. When a de-identifcation process is associated with low privacy loss, releasing the data it produces should result in only a small amount of additional risk for individuals in the input dataset. Some formal models, such as differential privacy, allow for composing the privacy losses of multiple data releases to quantify the increased privacy loss to individuals from each release, even if an attacker attempts to combine the releases in unanticipated ways. Other formal models, such as k-anonymity, do not have this capability.

An upper bound on the total acceptable privacy loss of many data releases is often called a privacy loss budget or simply a privacy budget. This number quantifes the total privacy loss to an individual who participates in all of the releases.

Differential privacy [53] is a rigorous mathematical defnition of disclosure that consid-ers the increase in accuracy with which an individual’s confdential data may be estimated as a result of a mathematical analysis based on that data being made publicly available. Statisticians, mathematicians, and other kinds of privacy engineers then develop mathe-matical algorithms called mechanisms, which process data in a way that is consistent with the defnition. Differential privacy limits properly defne inferential disclosure by adding non-deterministic noise (random values) to the results of mathematical operations before the results are reported. Differential privacy is based on information theory and makes no distinction between which data are considered identifying and which are not. Nor does using differential privacy require classifying data as direct identifers, quasi-identifers, or non-identifying values. Instead, the most widely used variants of differential privacy – such as ε-DP, (ε,δ)-DP, and zero-Concentrated Differential Privacy [23] – assume that all values in a confdential record must be protected.

Differential privacy’s mathematical defnition is based on the intuition that the distinctive attributes that contribute to an individuals’ data privacy cannot be violated by the analysis of a dataset that does not contain that individual’s data. As a result, the mathematical defnition of differential privacy is based on the idea of bounding the ratio of information gain possible from an analysis of a dataset with and without the data of any possible single individual. The defnition is usually satisfed by adding random noise to the result of a query, ensuring that the added noise masks that hypothetical individual’s contribution. The degree of sameness is defned by the parameter ε (epsilon) or ρ (rho). The smaller the parameter ε or ρ, the more noise is added, and the more diffcult it is to distinguish the contribution of a single individual. The result is increased privacy for all individuals – both those in the sample and those in the population from which the sample is drawn who are not present in the dataset. The research literature describes differential privacy being used to solve a variety of tasks, including statistical analysis, machine learning, and data sanitization [51]. However, the theory and practice of differential privacy is still in their infancy, and at present, they are not suffciently well-developed enough to produce privacy-protecting synthetic microdata that preserve interactions between more than a few independent variables.¹³

Differential privacy can be implemented in an online query system or in a batch mode in which an entire dataset is de-identifed at one time. In common usage, the phrase “differ-ential privacy” is used to describe both the formal mathematical framework for evaluating privacy loss and for algorithms that provably provide those formal privacy guarantees. Be-cause of the potential for ambiguity, users of differential privacy should clearly state what they mean by the term and what is actually differentially private in their system and data release.

Algorithms that implement differential privacy do not guarantee that privacy will be pre-served. Instead, these algorithms place mathematical bounds on what an attacker can learn about the confdential information that was used to produce a specifc data publication. Ad-ditionally, the privacy guarantee is limited to the privacy loss that an individual experiences based on an analysis of their own data and not from the what the same individual might experience from a statistical analysis of a dataset drawn from a population that does not include the their personal data (see Sec. 3.2.1, “Probability of Re-Identifcation”).

K-anonymity [137, 152] is a framework for quantifying the diffculty of singling out indi-vidual data records based on attributes termed quasi-identifers¹⁴ that are potentially iden-tifying. The technique is based on the concept of an equivalence class – the set of records that have the same values on the quasi-identifers. A dataset is said to be k-anonymous if there are no fewer than k matching records for every specifc combination of quasi-identifers. For example, if a dataset that has the quasi-identifers (birth year) and (state) has k = 4 anonymity, then there must be at least four records for every combination of (birth year, state). Subsequent work has refned k-anonymity by adding requirements for the di-versity of the sensitive attributes within each equivalence class (known as l-diversity [98]) and requiring that the resulting data be statistically close to the original data (known as t-closeness [94]).

Dozens of other privacy metrics beyond differential privacy and k-anonymity have been proposed. See “Technical Privacy Metrics: A Systematic Survey” for a more comprehen-sive listing [169].

All privacy techniques require the use of subject-matter experts (SMEs) to design the spe-cifc application of the technique and to validate that it has been implemented properly. For example, differential privacy requires experts to validate that all uses of confdential data go through the differential privacy mechanism, while k-anonymity requires the use of experts to determine the set of quasi-identifers by distinguishing between identifying and non-identifying information.

The k-anonymity technique and its subsequent refnements defne formal privacy models but come with an important drawback: k-anonymity and related techniques are not compo-sitional. That is, they do not quantify the cumulative privacy loss of multiple data releases, and multiple releases can interact in unpredictable ways, resulting in a catastrophic loss of privacy.

Finally, confdentiality breaches are not the only kinds of risks that can result from the re-lease of de-identifed data. Analysts working with de-identifed data often have no way of knowing if the de-identifcation process resulted in the addition of signifcant noise or bias in the resulting data. Thus, de-identifcation operations intended to protect the confdential-ity of data could result in inaccurate research fndings. For agencies with research missions, this threatens the integrity and reputation of the agency and calls into question the ability of the agency to fulfll its mission objectives. Such research might also cause harm if it is used to support harmful policies. Thus, agencies that release de-identifed data should explore options for describing the statistical impact that the de-identifcation process has on the data.

The decisions and practices regarding the de-identifcation and release of government data can be integral to the mission and proper functioning of a government agency. As such, these activities should be managed by an agency’s leadership in a way that ensures that performance and results are consistent with the agency’s mission and legal authority. As discussed above, the need for attention arises from the conficting goals of data trans-parency and privacy protection. Although many agencies once assumed that it was rela-tively straightforward to remove privacy-sensitive data from a dataset so that the remainder could be released without restriction, history shows that this is not the case [66, §2.4, §3.6].

Given this history, there may be a tendency for government agencies to either over-protect data or to simply avoid their release. Limiting the release of data clearly limits the privacy risk that might result from a data release. However, it also creates costs and risks for other government agencies, external organizations, and society. For example, in the absence of a data release, external organizations may suffer the cost of recollecting the data (if it is even possible to do so) or the risk of making poor decisions with insuffcient information.

This section begins with a discussion of why agencies may wish to de-identify data and how they should balance the benefts of data release with risks to the data subjects. It then discusses where de-identifcation fts within the data life cycle. It concludes by discussing the options that agencies have for adopting de-identifcation standards.¹⁵

Before engaging in de-identifcation, agencies should clearly articulate their goals regard-ing transparency and disclosure limitation in making a data release. They should then develop a written plan that explains how de-identifcation will be used to accomplish those goals.

For example:

Agencies may wish to seek legal guidance as to whether or not de-identifcation is permitted and what laws, regulations, and policies – if any – would cover de-identifed data.

Once the purpose of the data release is understood, agencies should identify the risks that might result from the data release and weigh them against the possible benefts.

Risk assessments should be based on objective scientifc factors and consider the best in-terests of the individuals in the dataset, the responsibilities of the agency holding the data, and the anticipated benefts to society. The goal of a risk evaluation is not to eliminate risk but to identify risks that can be reduced while still meeting the objectives of the data re-lease, and then deciding whether the residual risk is justifed by the data release goals. An agency decision-making process may choose to accept or reject the risk that might result from a release of de-identifed data, but participants in the risk assessment should not be empowered to prevent risk from being documented and discussed. Centralized processes also allow for the standardization of the risk assessment and the amount of “acceptable risk” across different programs’ releases.

As part of their risk analysis, agencies should specifcally evaluate the anticipated negative actions that might result from re-identifcation, as well as strategies for remediation. It is diffcult to measure re-identifcation risk in ways that are both general and meaningful. Such calculations may result in different levels of risk for different groups. There may be some individuals in a dataset who would be signifcantly adversely impacted by re-identifcation and for whom the likelihood of re-identifcation might be quite high, but these individuals may represent a tiny fraction of the entire dataset. This represents an important area for research in the feld of risk communication.

NIST provides guidance for conducting privacy risk assessments in NIST Internal Report (NISTIR) 8062, “An Introduction to Privacy Engineering and Risk Management in Federal Systems” [22], the NIST Privacy Framework: A Tool for Improving Privacy through Enter-prise Risk Management, and the NIST Privacy Risk Assessment Methodology (PRAM) [20], all of which can be downloaded from the NIST privacy engineering resources page located at https://www.nist.gov/itl/applied-cybersecurity/privacy-engineering/resources.

Less has been published regarding quantitative approaches for assessing the beneft of data releases. An Organization for Economic Cooperation and Development (OECD) report on the organization’s Open, Useful, and Re-usable data (OURdata) Index states:

Open government data promotes transparency, accountability and value creation by making government data available to all with no restriction for its re-use. Public bodies produce and commission huge quantities of data and information. By making their datasets available, public institutions become more transparent and accountable to citizens. By encouraging the use, reuse and free distribution of datasets, governments promote business creation and innovative, citizen-centric services. [116]

The OURdata index rates more than 30 countries according to their data availability and accessibility and government support for data reuse, but these metrics are relative because the report does not attempt to quantify the benefts of data release. At a 2018 conference, Ben Snaith, Peter Wells, and Anna Scott of the Open Data Institute wrote, “Is it possible to measure the value of data? Many now recognise how important data is [sic], but how it should be governed and regulated is often confused by a lack of consensus on how it can be valued” [142].

When conducting a risk analysis, agencies should consider whether the de-identified data will be made publicly available or only be distributed in a controlled manner with some sort of data-sharing agreement. Controlled distributions combined with data-sharing agreements that prohibit re-identification can significantly lower the risk of re-identification while still preserving many of the potential benefits, such as increased data-sharing and improved decision-making.

As discussed in Sec. 2.2, “Terminology,” potential impacts on individuals include inferential disclosure. Dwork [49, p. 1] first noted that “In 1977 Dalenius articulated a desideratum for statistical databases: nothing about an individual should be learnable from the database that cannot be learned without access to the database.” She proved “a general impossibility showing that a formalization of Dalenius’ goal along the lines of semantic security cannot be achieved.” Dwork and Naor [50, p. 95] proved that for any useful output algorithm, “there exists auxiliary information that an adversary might possess in the context of which the output ... would be disclosive.” Both papers refine the definition of inferential disclosure to distinguish between a confidentiality or privacy breach and a scientific or generalizable inference by “shift[ing] from absolute guarantees about disclosures to relative ones: any given disclosure – indeed, any output at all of the privacy mechanism – should be, within a small multiplicative factor, just as likely independent of whether any individual opts in to, or opts out of, the database” [50, p. 103].

It is necessary to “distinguish between identity and attribute inferences that depend upon the use of the protected entity’s data and those that are possible without using the protected entity’s information” [7, p. 12]. A confidentiality breach occurs when an inference about the attribute associated with a particular entity depends too much on the use of that entity’s data in producing the statistical output. According to Kifer et al. [88, p. 4], “(t)he differential privacy framework for SDL methods is designed precisely for the purpose of distinguishing between confidentiality breaches and valid scientific inferences.”

Re-identification probability¹⁶ is the probability that an individual’s identity will be correctly inferred by an outside party using information contained in a de-identified dataset. This outside party was originally termed a data intruder, although the terms adversary and attacker are also used in the literature, borrowing from the colorful language of information security.

Different kinds of re-identifcation probabilities for this data intruder can be calculated. Here are several kinds of probabilities, as well as proposals for new, declarative, self-describing names:

Known inclusion re-identifcation probability (KIRP) is the probability of fnding a record that matches a specifc individual known to be in the sample. KIRP can be expressed

Unknown inclusion re-identification probability (UIRP) is the probability of finding the record that matches a specific individual without first knowing whether the individual is in the dataset. UIRP can be expressed as a probability for an individual record in the dataset averaged over the entire population (AUIRP).¹⁸

Record-matching probability (RMP) is the probability of finding the record that matches a specific individual chosen from the population. Other useful metrics include the average record-matching probability (ARMP), which is the probability averaged over the entire dataset, and the maximum RMP for all of the individual records.

Inclusion probability (IP) is the probability that a specific individual’s presence in the dataset can be inferred.

Whether it is necessary to quantitatively estimate these probabilities depends on the specifics of each intended data release. For example, many cities publicly disclose whether taxes have been paid on a property. Given that this information is already a matter of public record, it may not be necessary to consider inclusion probability when a dataset of property taxpayers for a specific dataset is released. Likewise, there may be some attributes in a dataset that are already public and may not need to be protected with disclosure limitation techniques. However, the existence of such attributes may pose a re-identification risk for other information in the dataset or in other de-identified datasets. The fact that information is public may not negate the responsibility of an agency to provide protection for that information, as the aggregation and distribution of information may cause privacy risks that were not otherwise present. Agencies may also be legally prohibited from releasing copies of information that are similar to information that is already in the public domain.

Although disclosures are commonly thought to be discrete events involving the release of specifc data, such as an individual’s name matched to a record, disclosures can result from the release of data that merely changes a data intruder’s probabilistic belief. For example, a disclosure might change an intruder’s estimate that a specifc individual is present in a dataset from a 50 % probability to 90 %. The intruder still does not know if the individual is in the dataset or not (and the individual might not, in fact, be in the dataset), but a probabilistic disclosure has still occurred because the intruder’s estimate of the individual has been changed by the data release. This is similar to the (p,q) rule (also known as the ambiguity rule) in the SDL literature (see 105).

It may be diffcult to estimate specifc re-identifcation probabilities, as the ability to re-identify depends on vulnerabilities such as the original dataset, the de-identifcation tech-nique, and the availability of additional data (publicly available or privately held) that can be linked with the de-identifed data, as well as specifc threats, such as the technical skill of the data intruder and the intruder’s available resources and motivation. It is likely that the true probability of re-identifcation increases over time as vulnerabilities are likely to increase, such as improvement in re-identifcation techniques and the availability of more contextual information.

Some researchers have claimed that computing these probabilities “is a fundamentally meaningless exercise” because the calculations are based on assumptions that cannot be validated (e.g., the lack of a database that could link specifc quasi-identifers or sensitive, non-identifying values to identities) [108]. To avoid such a “meaningless exercise,” de-identifcation practitioners must become experts in the range of relevant data that is in both public and private datasets, especially those that are sold by data brokers. Such knowledge must include the quasi-identifers that the datasets contain, their accuracy, and the abil-ity to generate nearly complete population registers. It is important to recognize practical limitations that apply to potential data intruders and not assume omniscient or omnipotent capabilities to the detriment of the practical data privacy or accuracy trade-offs. However, it is also important to account for unknown datasets that may become available in the future.

De-identifcation practitioners have traditionally quantifed re-identifcation probability based in part on the skills and abilities of a potential data intruder. In some cases, datasets that were thought to have little possibility for exploitation were deemed to have a lower re-identifcation probability than datasets that contained sensitive or otherwise valuable infor-mation. It is not appropriate to consider the degree of potential exploitation when attempt-ing to evaluate the re-identifcation probability of government datasets that will be publicly released.

De-identifcation practitioners should assume that de-identifed government datasets could be subjected to sustained, worldwide re-identifcation attempts, and they should gauge their de-identifcation requirements accordingly. Of course, it is unrealistic to assume that all of the world’s resources will be used to attempt to re-identify every publicly re-leased fle. Therefore, de-identifcation requirements should be gauged using a risk assess-ment [97]. More information on conducting risk assessments can be found in NIST SP 800-30, Guide for Conducting Risk Assessments [149], in NISTIR 8062 [22], and using the NIST PRAM [20] discussed in Sec. 3.2. Members of at-risk and vulnerable populations¹⁹ may be more susceptible to having their identities disclosed by de-identifed data than other populations because the characteristic that makes these individuals vulnerable may also make them stand out in the dataset. Like-wise, residents of areas with small populations may be more susceptible to having their identities disclosed than residents of areas with large populations. Individuals with multi-ple traits will generally be more identifable if the individual’s location is geographically restricted. For example, data belonging to a person who is labeled as a pregnant, unem-ployed veteran will be more identifable if restricted to Baltimore County, Maryland, than to all of North America.

If agencies determine that the potential for harm is large in a contemplated data release, one way to manage the risk is by increasing the level of de-identifcation and accepting a lower data accuracy level. This lower level should be communicated to users of the dataset. Other options include data controls, such as restricting the availability of data to qualifed researchers in a data enclave.

As part of a risk analysis, agencies should attempt to enumerate the specifc kinds of ad-verse impacts that can result from the re-identifcation of de-identifed information. These can include potential impacts on individuals, the agency, and society.

Potential adverse impacts on individuals include:

Potential adverse impacts on agencies include:

The cascading impacts of re-identifcation and other breaches threaten all agencies, not just the agency that owns the re-identifed data. Potential adverse impacts include:

Please see the NIST PRAM [20]

One way to calculate the upper bound on an impact to an individual or agency is to es-timate the impact that would result from the inadvertent release of the original dataset. This approach will not calculate the upper bound on the societal impact, however, since that impact includes reputational damage to the practice of de-identifcation itself. That is, every time data are compromised because of a poorly executed de-identifcation effort, it becomes harder to justify the use of de-identifcation in future data releases.

As part of a risk analysis process, organizations should enumerate the specifc measures that they will take to minimize the risk of successful re-identifcation. Organizations may wish to consider both the actual risk and the perceived risk to those in the dataset and in the broader community.

As part of the risk assessment, an organization may determine that there is no way to achieve the de-identifcation goal in terms of data accuracy and identifability. In these cases, the organization will need to decide whether it should adopt additional measures to protect privacy (e.g., administrative controls or data use agreements), accept a higher level of risk, or choose not to proceed with the project.

The “Privacy Risk Assessment” section of the NIST Privacy Engineering Program web-site²⁰ contains tools and use cases for agencies and others interested in conducting privacy risk assessments.

The use of de-identifed data can lead to adverse impacts other than re-identifcation, though risk assessments that evaluate the risks of re-identifcation can address these other risks as well. Such risks might include:

It preferable to use de-identifcation processes that include assessments of data accuracy, including bias and variability components (e.g., confdence intervals based on root mean squared error). When it does not provide information that may aid data intruders, it is also useful to reveal the de-identifcation process itself so that analysts can understand any potential inaccuracies that might be introduced by the de-identifcation. This is consistent with Kerckhoffs’s principle [86], a widely accepted system design principle that holds that the security of a system should not rely on the secrecy of the methods that it employs.

As part of a risk analysis process, agencies should attempt to enumerate the techniques that could be used to mitigate or remediate harm that would result from a successful re-identifcation of de-identifed information. Remediation could include victim education, the procurement of monitoring or security services, the issuance of new identifers, or other measures.

The NIST Big Data Interoperability Framework defnes the data life cycle as “the set of pro-cesses in an application that transform raw data into actionable knowledge” [112]. The data life cycle can be used in the de-identifcation process to help analyze the expected benefts, intended uses, privacy threats, and vulnerabilities of de-identifed data. As such, the data life cycle concept can be used to select appropriate privacy controls based on a reasoned analysis of the threats. For example, the NIST Privacy Framework [113] and other privacy-by-design concepts [28] can be employed to decrease the number of identifers collected, thus minimizing the requirements for de-identifcation prior to data release. The data life cycle can also be used to design a tiered access mechanism based on this analysis [12].

Several data life cycles have been proposed, but none are widely accepted as a standard.

Michener et al. [105] (Figure 1) describe the data life cycle as a true cycle: → Assure → Describe → Deposit → Preserve → Discover → Integrate → Analyze → Collect

Stobierski [148] also describes the data life cycle as a cycle with different steps: Generation → Collection → Processing → Storage → Management → Analysis → Visualization → Interpretation → Generation

De-identifcation does not ft into a circular data life cycle model, as the data owner typ-ically retains access to the identifed data. However, if the organization employs de-identifcation, it could be performed during Collect or between Collect and Assure if iden-tifed data were collected but the identifying information was not actually needed. Alter-natively, de-identifcation could be applied after Describe and prior to Deposit to avoid archiving identifying information.

Chisholm and others [30] (Figure 2) describe the data life cycle as a linear process with a fork for data publication: Data Capture → Data Maintenance → Data Synthesis → Data Usage → {Data Publication and Data Archival → Data Purging}

Using this formulation, de-identifcation can take place either during Data Capture or fol-lowing Data Usage. However, agencies should consider data release requirements from

Fig. 1. The data life cycle as described by Michener et al. [105]

Fig. 2. Chisholm’s view of the data life cycle is a linear process with a branching point after data usage [30]

For example, if specifc identifers are not needed for maintenance, synthesis, and usage, then those identifers should not be collected. If fully identifed data are needed within the organization, the identifying information can be removed prior to the data being published, shared, or archived. Applying de-identifcation throughout the data life cycle minimizes privacy risk and signifcantly eases the process of public release. However, agencies should be cognizant of the potential loss of future utility if identifers are permanently removed. For this reason, agencies may wish to retain an identifed dataset or data-linking informa-tion, as it may be diffcult to predict future needs.

Altman et al. [97] (Figures 3 and 4) propose a “modern approach to privacy-aware gov-ernment data releases” that incorporates progressive levels of de-identifcation as well as different kinds of access and administrative controls in line with the sensitivity of the data.

Agencies that perform de-identifcation should document that:

Fig. 3. Altman’s “modern approach to privacy-aware government data releases” [97]

Fig. 4. Altman’s conceptual diagram of the relationship between post-transformation identifiability, the level of expected harm, and the suitability of selected privacy controls for a data release [97]

No matter where de-identification is applied in the data life cycle, agencies should document the answers to the following questions for each de-identified dataset:

Agencies should decide on the data-sharing model that will be used to make the data available outside of the agency after the data have been de-identified [66, p. 14]. Specific models combine security, privacy and disassociability techniques to reduce privacy risks to individuals.

Here we use the term security to refer to techniques that limit who can view the data, and privacy to refer to techniques that limit what information the data contains. Disassociability is the degree to which the information in the data can be used while limiting the association to individuals or devices beyond the operational requirements of the system. These con-cepts can be considered independently. In practice, however, who has access to the data and the degree to which the data are associated with individuals or devices makes a signifcant difference to the expected risk of disclosure and, therefore, infuences the extent to which privacy techniques must be used to limit the presence of sensitive personally identifable information in the data.

The Advanced Encryption Standard (AES) symmetric encryption algorithm, which is one of several traditional encryption algorithms, is an example of a security technique since it allows only the party holding the encryption key to view the data. However, advanced cryptographic techniques that combine secure multiparty cryptography with the application of differential privacy can provide both security, privacy and even disassociability capabilities (see Sec. 3.9.2).

A number of possible models exist at different points in the spectrum of security and privacy protections. Figure 4 summarizes this spectrum: its x-axis describes various privacy techniques that can limit the informational content of the data; its y-axis describes how much harm would occur if the underlying information were disclosed; and the regions of the graph are labeled with suggested security techniques. Some common combinations of security and privacy techniques include:

The release-and-forget model [123]. The de-identified data may be released to the public, typically by being published on the internet. It can be difficult or impossible for an organization to recall the data once released in this fashion and may limit information for future releases.

The Data Use Agreement (DUA) model. The de-identified data may be made available under a legally binding data use agreement that details what can and cannot be done with the data. Typically, DUAs include security provisions and may prohibit attempted re-identification, linking to other data, and redistribution of the data without a similarly binding DUA. A DUA will typically be negotiated between the data holder and qualified researchers (the “qualified investigator model” [58]) or members of the general public (e.g., citizen scientists or the media), although they may be simply posted on the internet with a click-through license agreement that must be agreed to before the data can be downloaded (the “click-through model” [58]).

The synthetic data with validation model. Statistical disclosure limitation techniques are applied to the original dataset and used to create a synthetic dataset that contains many of the aspects of the original dataset but does not contain disclosing information. The synthetic dataset is released, either publicly or to vetted researchers. The synthetic dataset can then be used as a proxy for the original dataset, and if constructed well, the results of statistical analyses should be similar. If used in conjunction with the enclave model, researchers may use the synthetic dataset to develop queries and/or analytic software. These queries and/or software can then be taken to the enclave or provided to the agency and applied on the original data. There are a growing number of techniques for using differential privacy to create synthetic data.

The enclave model [58, 114, 141]. The de-identified data may be kept in a segregated enclave that restricts the export of the original data and instead accepts queries from qualified researchers, runs the queries on the de-identified data, and responds with results. Enclaves can be physical or virtual and can operate under a variety of different models. For example, vetted researchers may travel to the enclave to perform their research, as is done with the Federal Statistical Research Data Centers operated by the U.S. Census Bureau. Enclaves may be used to implement the verification step of the synthetic data with validation model. Queries made in the enclave model may be vetted automatically or manually (e.g., by the DRB). Vetting can try to screen for queries that might violate privacy or are inconsistent with the stated purpose of the research. However, even vetted queries may lead to unanticipated privacy risks when the results are released and combined with external data.

Sharing models should consider the possibility of multiple or periodic releases. Just as repeated queries to the same dataset may leak personal data from the dataset, repeated de-identified releases (whether from the same dataset or from different datasets that contain some of the same individuals) by an agency may result in compromising the privacy of individuals unless each subsequent release is viewed in light of the previous release. Even if a contemplated release of a de-identified dataset does not directly reveal identifying information, federal agencies should ensure that the release – combined with previous releases – will also not reveal identifying information [167].

Instead of sharing an entire dataset, the data owner may choose to release a sample. If only a sample is released, the probability of re-identification decreases because a data intruder will not know whether a specific individual from the data universe is present in the de-identified dataset [57]. However, releasing only a sample may decrease the statistical power of tests on the data, may cause users to draw incorrect inferences if proper statistical sampling methods are not used, or may not align with agency goals regarding transparency and accountability.

Agencies should use a repeatable methodology for evaluating the terms under which data will be made available, such as The Five Safes [42, 16]. The Five Safes was created in the United Kingdom to assist a national statistical agency in evaluating proposed collaborative projects with a larger research community. The framework was developed to assist in “designing, describing and evaluating” data access systems. Here, the term “data access system” is viewed broadly as any mechanism that allows outsiders to gain access to the agency’s confdential data. That is, a data access system might include setting up an enclave for academic researchers who undergo extensive background checks, but it also includes publishing data on the internet.

The Five Safes framework derives its name from the use of fve categories (called “risk” or “access” dimensions) that are used in the evaluation:

The legal, moral, and ethical reviews of each of these dimensions are independent of the others. In practice, this might mean that the project is safe (the proposed use of the appropriate), the people are safe (e.g., the researchers are noted academics with respected histories of collaborative work), the data are safe (i.e., there is no disclosure risk in the data), and the output is safe (i.e., it will not disclose personal information). However, because the setting is not safe (perhaps the facility has poor internal security), the project should not go forward. In this example, the Five Safes framework would provide a decision-maker with the tools to separate each of these dimensions and resolve the problems so that the project can proceed.

One of the positive aspects of the Five Safes framework is that it forces data controllers to consider many different aspects of data release when evaluating data access proposals. It is common for data owners to “focus on one, and only one, particular issue (such as the legal framework surrounding access to their data or [Information Technology] (IT) solutions).” With the Five Safes, people who may be specialists in one area are forced to consider (or to explicitly not consider) aspects of privacy protection with which they may not be familiar and might otherwise overlook.

The so-called evidence-based, default-open, risk-managed, user-centered (EDRU) approach [73, 136], which provides tools for putting these decisions into context and weighing potential risks against potential benefts.

Agencies should determine if a framework such as The Five Safes is appropriate for designing access systems, evaluating existing systems, communication, and training.

Disclosure Review Boards (DRBs), also known as Data Release Boards, are administrative bodies created within an organization that are charged with ensuring that intended disclosures meet the policy and procedural requirements of that organization. DRBs provide organizations with a structured approach for identifying, managing and documenting risks associated with data publishing in a systematic, consistent and accountable manner. DRBs can act as a center to keep records and release reports. DRBs also allow for the accumulation of disclosure avoidance expertise within an organization and can serve as centers of training and advocacy for proper disclosure handling practices. As such, DRBs can be a powerful tool to allow agencies and their Chief Data Officers to comply with the legal requirements of the Evidence Act and with its implementation memorandum M-19-23. [168]²³

DRBs should be governed by a written mission statement and charter (or equivalent document) that are ideally approved by the same mechanisms that the organization uses to approve other organization-wide policies.

The DRB should have a mission statement that guides its activities. For example, the U.S. Department of Education’s DRB has the mission statement:

The Mission of the Department of Education Disclosure Review Board (ED-DRB) is to review proposed data releases by the Department’s principal offices (POs) through a collaborate technical assistance, aiding the Department to release as much useful data as possible, while protecting the privacy of individuals and the confidentiality of their data, as required by law. [54]

Most DRBs are established to weigh the interests of data release against those of individual privacy protection. However, a DRB may also be chartered to consider group harms [66, p. 13] that can result from the release of a dataset. Such harms go beyond the harm to the privacy interests of a specific individual.

The DRB charter specifies the mechanics of how the mission is implemented. A formal, written charter promotes transparency in the decision-making process and ensures consistency in the application of its policies. The DRB charter should frame the DRB’s responsibilities in reference to existing organizational policies and components, as well as applicable regulations and laws. Some agencies may balance these concerns by employing data use models other than de-identification (e.g., by establishing data enclaves where a limited number of vetted researchers can access sensitive datasets in a way that provides data value while minimizing the possibility for harm or by authorizing the use of secure multi-party computation, homomorphic encryption, or other privacy-preserving data analytics to compute various statistics). In those agencies, a DRB would be empowered to approve the use of such mechanisms.

Certain agencies may engage in data disclosure on a routine basis (e.g., research and evaluation agencies), in which case it may be beneficial for the DRB to establish policies and procedures for de-identification rather than being responsible for every review. The DRB charter should clearly specify how the group will provide oversight and ensure organizational accountability to the agreed-upon policies.

the Information Quality Act (IQA), record disclosure laws and policy, and the Paperwork Reduction Act (PRA).” (p. 23) The memo’s further states that an agency’s Annual Evaluation Plans will discuss how infor-mation will be disseminated and used while taking into account “applicable law and policies governing the collection, use, and disclosure of data and information.” (p. 35) Footnote 34 on p. 22 cites section 202(e) of the evidence act noting that the Chief Data Offcer “shall be designated on the basis of demonstrated training and experience in data management, governance (including creation, application, and maintenance ofdata standards), collection, analysis, protection, use, and dissemination, including with respect to any statistical and related techniques to protect and de-identify confdential data.”

The DRB charter should also specify the DRB’s composition. To be effective, the DRB should include representatives from multiple groups and experts in both technology and privacy policy. Specifcally, DRBs may wish to have as members:

The charter should establish rules for ensuring a quorum and specify whether members can designate alternates on a standing or meeting-by-meeting basis. The DRB should specify the mechanism by which members are nominated and approved, their tenure, conditions for removal, and removal procedures.²⁴

The charter should set policy expectations for record keeping and reporting, including whether records and reports are considered public or restricted. For example, the charter could direct the DRB to issue an annual report with a list of every dataset that was approved for release. The charter should indicate whether it is possible to exclude sensitive decisions from these reporting requirements and the mechanism for doing so. Ideally, the charter should be a public document to promote transparency.

To meet its requirement of evaluating data releases, the DRB should require that written applications be submitted to the DRB that specify the nature of the dataset, the de-identification methodology, and the result. An application may require that the proposer present the re-identification risk, the risk to individuals if the dataset is re-identified, and a proposed plan for detecting and mitigating successful re-identification. In addition, the DRB should require that when individuals are informed that their information will be de-identified, they also be informed that privacy risks may remain despite de-identification.

The DRB should keep accurate records of its request memos, their associated documentation, the DRB decision, and the actual files released. These records should be appropriately archived and curated so that they can be recovered. In the case of large data releases, the definitive version of the released data should be curated using an externally validated procedure, such as a recorded cryptographic hash value or signature, and a digital object identifier (DOI) [83].

DRBs may wish to institute a two-step process in which the applicant first proposes and receives approval for a specific de-identification process that will be applied to a specific dataset and then submits and receives approval for the release of the dataset that has been de-identified according to the proposal. However, because it is theoretically impossible to predict the results of applying an arbitrary process to an arbitrary dataset [31, 159], the DRB should be empowered to reject a proposed release of a dataset even if it has been de-identified in accordance with an approved procedure because performing the de-identification may demonstrate that the procedure was insufficient to protect privacy. The DRB should be able to delegate the responsibility of reviewing the de-identified dataset, but such responsibility should not be delegated to the individual or group that performed the de-identification.

The DRB charter should specify whether the DRB needs to approve each data release by the organization or if it may grant blanket approval for all data of a specifc type that are de-identifed according to a specifc methodology. The charter should specify the duration of the approval. Given advances in the science and technology of de-identifcation, a Board should not be empowered to grant release authority for an indefnite or unlimited amount of time.

In most cases, a single privacy protection methodology will be insufficient to protect the varied datasets that an agency may wish to release. That is, different techniques might best optimize the trade-off between re-identification risk and data usability, depending on the specifics of each kind of dataset. Nevertheless, the DRB may wish to develop guidance, recommendations, and training materials regarding specific de-identification techniques that are to be used. Agencies that standardize on a small number of de-identification techniques will gain familiarity with these techniques and are likely to have results with a higher level of consistency and success than those that have no such guidance or standardization.

Although it is envisioned that DRBs will work in a cooperative, collaborative, and congenial manner with those inside an agency seeking to release de-identified data, there will at times be a disagreement of opinion. For this reason, the DRB’s charter should state whether the DRB has the final say over disclosure matters or if the DRB’s decisions can be overruled, by whom, and by what procedure. For example, an agency might give the DRB final say over disclosure matters but allow the agency’s leadership to replace members of the DRB as necessary. Alternatively, the DRB’s rulings may merely be advisory, with all data releases being individually approved by agency leadership or its delegates.²⁵

Agencies should decide whether the DRB charter will include any kind of performance timetables or be bound by a service-level agreement (SLA) that defnes a level of service to which the DRB commits.

The key elements of a Disclosure Review Board include:

Example outputs of a DRB include specifying access methods for different kinds of data releases, establishing acceptable levels of re-identifcation risk, and maintaining detailed records of previous data releases that ideally include the dataset that was released and the privacy-preserving methodology that was employed.

There is some similarity between DRBs as envisioned here and the Institutional Review Board (IRBs) system created by the Common Rule²⁶ for regulating human subject research in the United States. For example, both IRB and DRB members require an understanding of ethical principles, public policy and an understanding of how the collection and release of data can cause harms to individuals. However, there are also important differences:

Agencies can rely on de-identification standards to provide standardized terminology, procedures, and performance criteria for de-identification efforts. Agencies can adopt existing de-identification standards or create their own. De-identification standards can be prescriptive or risk-based.

De-identifcation standards assist agencies with the process of de-identifying data prior to public release. Without standards, data owners may be unwilling to share data, as they may be unable to assess whether a procedure for de-identifying is suffcient to minimize privacy risk.

Standards can increase the availability of individuals with appropriate training by identifying a specific body of knowledge and practice that training should address. Absent standards, agencies may forego opportunities to share data. De-identification standards can help practitioners develop a community, as well as certification and accreditation processes.

Standards decrease uncertainty and provide data owners and custodians with best practices to follow. Courts can consider standards as acceptable practices that should generally be followed. In the event of litigation, an agency can point to the standard and say that it followed good data practice.

A prescriptive de-identification standard specifies an algorithmic procedure that – if followed – results in data that are de-identified to a previously established benchmark. This approach focuses on the process of de-identification rather than on the specific properties of the de-identified data.

The Safe Harbor method of the HIPAA Privacy Rule [3] is an example of a prescriptive de-identifcation standard. The intent of the Safe Harbor method is to “provide covered entities with a simple method to determine if the information is adequately de-identifed” [118]. It does this by specifying that health information is considered to be de-identifed through the removal of 18 kinds of identifers and the explicit assurance that the entity does not have actual knowledge that the remaining information can be used to identify an individual who is the subject of the information. Once de-identifed, the dataset is no longer subject to HIPAA privacy, security, and breach notifcation regulations. Nevertheless, “a covered en-tity may require the recipient of de-identifed information to enter into a data use agreement to access fles with known disclosure risk” [118].

As noted on page 5, Guidance from the U.S. Department of Health and Human Ser-vices (HHS) on the Health Insurance Portability and Accountability Act (HIPAA) de-identifcation standards states that even when properly applied, both the Safe Harbor and expert determination methods for de-identifcation ”yield de-identifed data that retains some risk of identifcation. Although the risk is very small, it is not zero, and there is a possibility that de-identifed data could be linked back to the identity of the patient to which it corresponds” [166]. Specifcally, the combination of quasi-identifers (indirect identifers) left in the de-identifed dataset (e.g., race, gender, income and education level) may raise re-identifcation issues.

The Privacy Rule states that a covered entity that employs the Safe Harbor method must have no “actual knowledge” that the information – once de-identifed – could still be used to re-identify individuals. However, covered entities are not obligated to employ experts or mount re-identifcation attacks against datasets to verify that the use of the Safe Harbor method has in fact resulted in data that cannot be re-identifed.

Prescriptive standards have the advantage of being relatively easy for users to follow, but developing, testing, and validating such standards can be burdensome. Because prescriptive de-identifcation standards do not depend on the particulars of a specifc case, there is a tendency for them to be more conservative than is necessary, resulting in a decrease in data for corresponding levels of risk. Even so, there is typically no mathematically provable assurance that following a procedure specifed by the standard actually produces the intended privacy-preserving outcome.

Agencies that create prescriptive de-identifcation standards should ensure that data de-identifed according to the standards have a suffciently small risk of being re-identifed consistent with the intended level of privacy protection. Such assurances frequently cannot be made unless formal privacy techniques (e.g., differential privacy) are employed, and the assurances made by differential privacy are unlike the simplistic absolute assurances made in the context of traditional SDL techniques. Agencies may nevertheless determine that public policy goals furthered by having an easy-to-use prescriptive standard outweighs the risk of a standard that does not have provable privacy guarantees.²⁷ If such determinations are made, they should be clearly documented.

Prescriptive de-identification standards carry the risk that the standard may not sufficiently de-identify to avoid the risk of re-identification, especially as methodology advances and more data sources become available. A second risk is that different agencies (or governments) may adopt inconsistent rules. In such cases, information that is legally de-identified for one purpose or in one jurisdiction may not be legally de-identified in another.

Risk-based de-identifcation standards specify the properties that de-identifed data must have rather than the process that was used to create the de-identifed data. For example, under the “Expert Determination” method of the HIPAA Privacy Rule, a technique for de-identifying is suffcient if an appropriate expert applying generally accepted statistical and scientifc principles and methods “determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information” [118]. The rule requires that experts document their methods and the results of their analyses.

Risk-based standards have the advantage of allowing users many different ways to solve a problem by leaving room for innovation. Another advantage is that they can require the desired outcome rather than specifying an aspirational mechanism.

There are two fundamental challenges with the risk-based approach:

Risk-based standards should be suffciently detailed to perform in a manner that is reliable and repeatable. For example, standards that call for the use of experts can specify how an expert’s expertise should be determined. Standards that call for the reduction of risk to an acceptable level should provide a procedure for determining that level.

De-identifying data in a manner that preserves privacy can be a complex mathematical, statistical, administrative, and data-driven process. Frequently, the opportunities for identity disclosure will vary from dataset to dataset. Privacy-protecting mechanisms developed for one dataset may not be appropriate for others. For these reasons, agencies that engage in de-identifcation should ensure that their workers have adequate education and training in the subject domain. Agencies may wish to establish education or certifcation requirements for those who work directly with the datasets or to adopt industry standards, such as the HITRUST De-Identifcation Framework [101]. Because de-identifcation techniques are modality-dependent, agencies using de-identifcation may need to institute research efforts to develop and test appropriate data release methodologies.

Although some de-identifcation standards may call for training data recipients [82], this is typically not an option for government datasets that are made freely available on the public internet.

In addition to de-identifcation, there are other technologies and methodologies that can secure sensitive data. Many of these approaches can complement de-identifcation and further reduce privacy risk to data subjects. Combining techniques is an example of defense in depth and should be considered whenever possible. The NIST Privacy Framework [113] provides more information about additional measures for defense in depth.

Encrypting sensitive data at rest can prevent attackers from obtaining the data directly (e.g., by compromising the server that stores it). Encryption can also serve as a form of access control (i.e., it can control who can access the data) because examining the data requires access to the encryption keys. If the original data (with identities) are retained, they should be stored encrypted, and access should be limited. Even after de-identifcation, more sensitive data not intended for public release can be provided to select individuals by limiting access via encryption.

Two technologies enable computing on encrypted data without decrypting it:

Note that even when secure computing approaches are employed, the outputs of the computations can still compromise privacy if they are not protected with a formal privacy mechanism, such as differential privacy.

For more information on secure computation techniques and the efforts of the U.S. government to advance their use, see the National Strategy to Advance Privacy-Preserving Data Sharing and Analytics [41].

Trusted execution environments (TEEs) (also called trusted hardware enclaves or secure hardware enclaves) are another approach for computing encrypted data. TEEs are implemented in computer hardware, typically within the silicon of a modern central processing unit (CPU), and protect programs that run on that CPU from the surrounding environment. For example, a TEE can cause data from a computer’s CPU to be automatically encrypted when written to main memory and decrypted when read back to the CPU. In this way, data in memory are protected from other devices that can access memory, such as a network interface card. In addition to encryption, TEEs typically support attestation so that a program running on a TEE can attest to a remote system that the result is a true, legitimate, and faithful execution of the program.

Traditional cloud services require trusting the cloud provider, who may have a compromised environment (e.g., an operating system that records encryption keys). A TEE decreases the need for trust because it allows a user to validate that they are communicating with the remote program and offers assurance that no other program running on the cloud provider can access the program’s data. Secure enclaves can thus allow untrusted infrastructure to operate on sensitive data in much the same way as technologies like FHE and MPC.

Intel’s Software Guard Extensions (SGX) [140], ARM’s TrustZone [131], and AMD’s Secure Encrypted Virtualization (SEV) [13] are all examples of secure hardware enclaves. All of these products are designed to provide similar security to cryptographic techniques while also providing performance similar to a single CPU operating on unencrypted data. These secure hardware products are necessarily complex, and various implementation errors have been discovered that can allow attackers to defeat their security protections. Secure hardware enclaves certainly offer increased security for data compared to plaintext computation, but agencies should carefully consider the trade-off between performance and security when choosing between secure hardware and cryptographic techniques.

For extremely sensitive data, a physical enclave ( Sec. 3.4) may provide additional security. In this model, data are stored on a computer that is not connected to any network and are accessible only via physical access to a particular room. Access to the data are then controlled by limiting access to the room. This approach can be quite cumbersome.

The goal of de-identifcation is to transform data in a way that protects privacy while pre-serving the validity of inferences drawn on that data within the context of a target use case. This section discusses technical options for performing de-identifcation and verifying the result of a de-identifcation procedure.

Agencies should adopt a detailed, written process for de-identifying data prior to com-mencing work on a de-identifcation project. The details of the process will depend on the particular de-identifcation approach that is pursued. In developing technical steps for data de-identifcation, agencies may wish to consider existing de-identifcation stan-dards, such as the HIPAA Privacy Rule [166, 3], ISO/IEC 27559:2022 (“Privacy enhancing data de-identifcation framework”) [82], the IHE De-Identifcation Handbook [79], or the HITRUST De-Identifcation Framework [101].

Agencies intent on de-identifying data for release should understand the nature of the data that they intend to de-identify and determine the policies and standards that will be used to determine acceptable levels of data accuracy, de-identifcation, and the risk of re-identifcation. For example:

Some goals and objectives are synergistic, while others are in opposition.

Different kinds of data require different kinds of de-identifcation techniques. As a result, an important early step in the de-identifcation of government data is to identify the data modalities that are present in the dataset and formulate a plan for de-identifcation that takes the goals for data release, data accuracy, privacy protection, and the best available science into account.

For example:

The k-anonymity [151] technique is commonly used for performing and evaluating the de-identifcation of tabular numeric and categorical data. However, risk determi-nations based on this kind of de-identifcation will be incorrect if direct and quasi-identifers are not properly classifed. For example, if there are quasi-identifers that are not identifed or subjected to k-anonymity, then it may be possible to re-identify records in the de-identifed dataset. Furthermore, because the mechanisms used to implement k-anonymity are data-dependent, it is possible to reverse-engineer the ap-plication of these mechanisms on the data and recover the data that were thought to be detected [32].

Tabular data may also be used to create a synthetic dataset that preserves some infer-ence validity but does not have a one-to-one correspondence to the original dataset.

In many cases, data are complex and contain multiple modalities. Such mixtures may complicate risk determinations.

De-identifcation based on removing identifers and transforming quasi-identifers is one of the most common approaches currently in use. It has the advantage of being conceptually straightforward, and there is a long institutional history of using this approach within both federal statistical agencies and the healthcare industry. This approach has the disadvantage of not being based on formal methods for ensuring privacy protection.

Below is a sample process for de-identifying data by removing identifers and transforming quasi-identifers:³⁰

Direct identifiers, such as names, phone numbers, and other information that unambiguously identifies an individual.

Quasi-identifers that could be used in a linkage attack. Typically, quasi-identifers identify multiple individuals and can be used to triangulate a specifc individual.

High-dimensional data [10] can be used to single out data records and, thus, constitute a unique pattern that could be identifying if the values exist in a secondary source to link against.³²

As noted on 13, this document uses the phrase de-identifcation to describe this process and recommends avoiding the phrase anonymization, which is typically used to indicate that the de-identifcation process cannot be reversed, and there is no technical mechanism to ensure that de-identifed data cannot be re-identifed.

There are many possible processes for removing direct identifers from a dataset, including:

Encryption, hashing with a keyed hash, and replacement with realistic surrogate values are pseudonymization techniques. The technique used to remove direct identifiers should be clearly documented for users of the dataset – especially if the technique of replacement by realistic surrogate names is used – so that future data users have documentation that the dataset has been de-identified.

Carefully consider the application of pseudonyms given the source of the direct identifer. Applying this method to certain values, like last name, can subject the de-identifed data to frequency distribution attacks for re-identifcation.

If the agency plans to make data available for longitudinal research and contemplates multiple data releases, then the transformation process should be repeatable, and the resulting transformed identities should be pseudonyms. The mapping between the direct identifier and the pseudonym is performed using a lookup table or a repeatable transformation. In either case, the release of the lookup table or the information used for the repeatable transformation will result in compromised identities. Thus, the lookup table or the information for the transformation must be highly protected. When using a lookup table, the pseudonym must be randomly assigned.

A signifcant risk of using a repeatable transformation is that a data intruder may be able to determine the transformation and, thus, gain the capability to re-identify all of the records in the dataset.

When multiple organizations use the same pseudonymization scheme, they can trade data and perform matching on the pseudonyms. This approach is sometimes called privacy-preserving record linkage (PPRL). However, even when matching is probabilistic (as is the case with PPRL techniques that employ Bloom filters), this practice allows the organizations to re-identify each other’s shared datasets. Some PPRL approaches perform record linkage within a secure data enclave to minimize the risk of unauthorized re-identification [111]. As an alternative, organizations can participate in a private set intersection protocol, of which there are many in the cryptographic literature [102, 45, 89].

The transformation of direct identifers through encryption or hashing carries special risks, as errors in procedure or the release of the key used in the encryption or hashing operation can compromise identities for the entire dataset. There is no way to verify that a key has not been released.

If a hashing key is not used or is discovered by an attacker, it is possible for an attacker to perform a brute force search and determine the original values of identifers that have been hashed.

When information is protected with encryption, the security of the encrypted data depends entirely on the security of the encryption key. If a key is improperly chosen, it may be possible for a data intruder to discover the key using a brute force search. Because there is no visual difference between data that are encrypted with a strong encryption key and data that are encrypted with a weak key, organizations must utilize administrative controls to ensure that keys are both unpredictable and suitably protected.

Because encryption may be reversed and both approaches may be the subject of a success-ful brute force attack, the use of encryption or hashing to protect direct identifers is not recommended [66, 154].

Once a determination is made regarding quasi-identifers, they should be transformed. A variety of techniques are available to transform quasi-identifers:

For example, instead of reporting that a person is 84 years old, the person may be reported as being 79 years old. Noise addition increases variance in reported statis-tics and leads to regression dilution, also known as attenuation bias, in estimated regression coeffcients and decreased correlations among attributes [47, 8]. When combined with a requirement for the non-negative reporting of attributes, such as age or population, noise addition may also introduce systematic bias since more val-ues are increased in value than decreased.

These techniques (and others) are described in detail in several publications, including:

Swapping and noise addition both introduce noise into the dataset, such that records lit-erally contain incorrect data. Certain kinds of noise addition have been mathematically proven to provide formal privacy guarantees. Swapping has no such guarantees.

All of these techniques impact data accuracy, but whether they impact data utility depends on the downstream uses of the data. For example, top-coding household incomes will not impact a measurement of the 90-10 quantile ratio, but it will impact a measurement of the top 1 % of household incomes [129].

Statistical agencies should document the specifc statistical disclosure techniques that they used when performing statistical disclosure limitation. Where possible, statistical agencies should document the specifc parameters used in data-protecting transformations [8]. This documentation should accompany the release of de-identifed data. Without such trans-parency, data users may reach erroneous conclusions regarding their working data [72, 150, 76, 6].

Dates can exist in many ways in a dataset. Dates may be in particular kinds of typed columns, such as a date of birth or the date of an encounter. Dates may be present as a number, such as the number of days since an epoch like January 1, 1900. Dates may be present in free text narratives or in photographs (e.g., a photograph that shows a calendar or a picture of a computer screen with date information).

Several strategies have been developed for de-identifying dates:

Geographical data can exist in many ways in a dataset. Geographical locations may be indicated by map coordinates (e.g., 39.1351966, -77.2164013), a street address (e.g., 100 Bureau Drive), or a postal code (e.g., 20899). Geographical locations can also be embedded in textual narratives.

Some geographical locations are less likely to be identifying (e.g., a crowded train station), while others may be highly identifying (e.g., a house in which a single person lives). Other locations may be identifying at some times of day and not others or during some months or some years. The amount of noise required to de-identify geographical locations signif-cantly depends on the availability of external data, including geographical surveys. Identity may be shielded in an urban environment by adding ±100 m, whereas a rural environment may require ±5 km or more to introduce suffcient ambiguity.

A prescriptive de-identifcation rule – even one that accounts for varying population densi-ties – may still be insuffcient for de-identifcation if the rule fails to consider the interac-tion between geographic locations and other quasi-identifers in the dataset. Randomized transformations should be made with caution to avoid the creation of inconsistencies in underlying data (e.g., moving the location of a residence along a coast into a body of water or across geopolitical boundaries).

Single locations may become identifying if they represent locations linked to a single in-dividual that are recorded over time (e.g., a work/home commuting pair). Such behavioral time-location patterns can be quite distinct and allow for re-identifcation even with a small number of recorded locations per individual [107, 106]. In 2021, one study concluded that “[t]he risk of re-identifcation remains high even in country-scale location datasets” [60].

Data of higher resolution are typically more identifying. For example, in July 2021, the Catholic publication The Pillar published a report in which it had purchased the de-identifed geolocation information for users of a homosexual dating platform. With these data, the journalists identifed a prominent Catholic offcial as a user of the platform by sim-ply matching the geolocation data to the offcial’s residence. The offcial promptly resigned [130].

Deoxyribonucleic acid (DNA) is the molecule inside human cells that carries the genetic instructions used for the proper functioning of living organisms. DNA present in the cell nucleus is inherited from both parents, while DNA present in the mitochondria is only inherited from an organism’s mother. DNA is a repeating polymer that is made from four chemical bases: adenine (A), guanine (G), cytosine (C), and thymine (T). Human DNA consists of roughly 3 billion bases, of which 99 % are the same in all people [69].

Modern technology allows for the complete specifc sequence of an individual’s DNA to be determined within a certain accepted error threshold, and full-genome sequencing is increasingly common as costs have dropped signifcantly below $1000 per genome in the United States. Even less expensive is the use of a DNA microarray to probe for the presence or absence of specifc DNA sequences at predetermined points in the genome. This ap-proach is typically used to determine the presence or absence of specifc single nucleotide polymorphisms (SNPs) [68]. DNA sequences and SNPs are the same for monozygotic (identical) twins, individuals resulting from divided embryos, and clones. With these ex-ceptions, it is believed that no two humans have the same complete DNA sequence. Indi-vidual SNPs may be shared by many individuals, but a suffciently large number of SNPs that show suffcient variability is generally believed to produce a combination that is unique to an individual.

Thus, there are some sections of the DNA sequence and some combinations of SNPs that have high variability within the human population and others that have signifcant con-servation between individuals within a specifc population or group. When there is high variability, DNA sequences and SNPs can be used to match an individual with a historical sample that has been analyzed and entered into a dataset. The inheritability of genetic in-formation has also allowed researchers to determine the surnames and even the complete identities of some individuals [74].

As the number of individuals who have their DNA and SNPs measured increases, scientists are realizing that the characteristics of DNA and SNPs in individuals may be more com-plicated than the preceding paragraphs imply. DNA changes as individuals age because of senescence, transcription errors, and mutation. DNA methylation, which can impact the functioning of DNA, also changes over time [19]. Individuals who are made up of DNA from multiple individuals – typically the result of the fusion of twins in early pregnancy – are known as chimera or mosaic. In 2015, a man in the United States failed a paternity test because the genes in his saliva were different from those in his sperm [87]. A hu-man chimera was identifed in 1953 because the person’s blood contained a mixture of two blood types: A and O [48]. The incidence of human chimeras is unknown.

Because of the high variability inherent in DNA, complete DNA sequences may be iden-tifable by linking with an external dataset. Likewise, biological samples for which DNA can be extracted may be identifable. Subsections of an individual’s DNA sequence and collections of highly variable SNPs may be identifable unless it is known that there are many individuals who share the region of DNA or those SNPs. Furthermore, genetic infor-mation may not only identify an individual but could also identify an individual’s ancestors, siblings, and descendants. It is also possible to identify certain diseases and whether an in-dividual is at risk for certain hereditary conditions. For example, the presence of the HER2 gene code is a marker for breast cancer risk.

Researchers must devote specifc attention when they de-identify text narratives and other kinds of qualitative information. Many approaches developed in the 1980s and 1990s that provided reasonable privacy assurances at the time may no longer provide adequate protec-tion in an era with high-quality internet search and social media [126, 127, 125]. This is an area of active research.

Aggregation does not necessarily provide privacy protection, especially when data are pre-sented in multiple data releases.

Consider a hypothetical example of a school that reports on its website the number of students performing below, at, and above grade level at the start of the school year (Table 1).

Reading Level at Start of School Year # of Students Below grade level

30-39

At grade level

50-59

Above grade level

20-29

Table 1. Reading levels at a hypothetical school, as measured by entrance examinations and reported at the start of the school year on October 1. (See example, Sec. 4.3.8)

Reading Level at Start of School Year # of Students Below grade level

30-39

At grade level

50-59

Above grade level

30-39

Table 2. Reading levels at a hypothetical school, as measured by entrance examinations and reported one month into the school year on November 1 after a single new student has transferred to the school. (See example, Sec. 4.3.8)

Then consider that a single new student enrolls at the school on October 15, and the school updates the table on its website (Table 2). Since the examination is only taken once, it is possible to infer that the student who joined the school is likely performing above grade level by comparing the two tables. This reveals protected information. Moreover, if a person who views both tables knows the specifc student who enrolled in October, they have learned a private fact about that student.

Aggregation does not inherently protect privacy, and aggregation alone is not suffcient to provide formal privacy guarantees. Other ad hoc rules that have been proposed include the threshold rule, the dominance rule, and the ambiguity rule. However, as has been noted, “aggregated data provides a false sense of security” [15]. An alternative is to use aggregation primitives based on formal privacy, which can provide aggregations that have provable privacy guarantees while remaining highly accurate in many cases. Such methods work through the addition of carefully calibrated noise.

Even after removing all of the unique identifers and manipulating the quasi-identifers, data can still be identifying if they are of suffciently high dimensionality and if there is a way to link the supposedly non-identifying values to an identity.³⁴

Data can be linked in many ways. Pseudonyms allow data records from the same individual to be linked together over time. Family identifers, such as distinctive family names or some kinds of genetic information, may allow data from parents to be linked with their children. Device identifers allow data to be linked to physical devices and potentially link together all data coming from the same device. Data can also be linked to geographical locations.

Data linkage increases the risk of re-identification by providing more attributes that can be used to distinguish the true identity of a data record from others in the population. For example, survey responses that are linked together by household are more readily re-identified than survey responses that are not linked. Heart rate measurements may not be considered identifying, but, given a long sequence of tests, each individual in a dataset would have a unique constellation of heart rate measurements, and the dataset could be susceptible to being linked with another dataset that contains the same values.³⁵ Geographical location data can – when linked over time – create individual behavioral time-location patterns that can be used to classify and single out an individual within unlabeled data, even with a small number of recorded locations per individual [107, 106].

Dependencies between records may result in record linkages even when there is no explicit linkage identifer. For example, it may be that an organization has new employees take a profciency test within seven days of being hired. This information would allow links to be drawn between an employee dataset that accurately reported an employee’s start date and a training dataset that accurately reported the date that the test was administered, even if the sponsoring organization did not intend for the two datasets to be linkable.

In computer science, the term composition refers to combining multiple functions to create more complicated ones. One of the defining characteristics of complex systems is that they have unpredictable behavior, even when they are composed of very simple components. A challenge of composition is to develop approaches for limiting or eliminating such unpredictable behavior. Typically, this is done by proactively limiting the primitives that can be composed. De-identification is such a primitive that statisticians and data scientists must carefully control to ensure that the results of de-identification efforts can be composed. Without such controls, the results of composition can become unpredictable.

Specifcally, it is important to understand whether the techniques used for de-identifying will retain their privacy guarantees when they are subject to composition. For example, if the same dataset is made available through two different de-identifcation regimes, what will happen to the privacy guarantees if the two downstream datasets are recombined? One of the primary advantages of differential privacy is that its operators are composable: if two

Composition concerns can arise when:

Privacy risk can result from unanticipated composition, which is one of the reasons that released datasets should be subjected to periodic review and reconsideration.

The de-identifcation process outlined in this section can fail to prevent a disclosure for a number of different reasons. In addition, failures of data utility can also occur, in which the de-identifcation process removes too much information, and the de-identifed dataset is not useful for its intended purpose.

Following the release of a de-identifed dataset, the releasing agency should monitor it to ensure that the assumptions made during the de-identifcation remain valid. This is because – absent the destruction of historical data – the identifability of a dataset can increase over time. For example, the de-identifed dataset may contain information that can be linked to an internal dataset that is later the subject of a data breach. In such a situation, the data breach could also result in the re-identifcation of the de-identifed dataset. The de-identifed dataset might also be linked to an external dataset released by a completely separate organization. Agencies have no control over the release of such datasets, and even monitoring may be challenging in this situation. In some cases, the de-identifed dataset might be linked with privately held data, making monitoring impossible.

Agencies should develop an action plan that specifes what the agency should do if post-release monitoring suggests the possibility of unwanted re-identifcation. For example, agencies may wish to use this information as grounds to determine the new probability of re-identifcation ( Sec. 3.2.1) as a result of the new public information. Based on the results of such research, agencies may wish to revise their policies or even notify the public.

Agencies may wish to make releasing units responsible for post-release monitoring or to centralize the post-release monitoring in a single location. However, proper post-release monitoring requires knowledge of the datasets that have been released and the kinds of data that would allow for a re-identifcation attack. These requirements are likely to increase costs to organizations that wish to delegate post-release monitoring to other organizations or third parties. One way to decrease the requirement for post-release monitoring is to perform the de-identifcation using a privacy model that does not make assumptions about the background information available to the data intruder.

An alternative to de-identifying using the technique presented in the previous section is to use the original dataset to create a synthetic dataset [46, p. 8].

Synthetic data can be created using two approaches:

Table 3. Adjectives used for describing data in data releases ( Sec. 4.4.4).

In both cases, formal privacy techniques can be used to quantify the privacy protection offered by the synthetic dataset.

A partially synthetic dataset is one in which an existing dataset is sampled, and either noise is added to specifc cells that are likely to have a high risk of disclosure, or else the contents of those cells are replaced with imputed values that are typically based on probabilistic models. For example, data that belong to two families in adjoining towns may be swapped to protect the identity of the families. Alternatively, the data for an outlier variable may be removed and replaced with a range value that is incorrect (e.g., replacing the value “60” with the range “30-35”). It is considered best practice for the data publisher to indicate that some values have been modifed or otherwise imputed but not to reveal the specifc values that have been modifed.

It is also possible to create test data that are syntactically valid but do not convey accurate information when analyzed. Such data can be used for software development. When creating test data, it is useful for the names, addresses, and other information in the data to be conspicuously non-natural so that the test data are not inadvertently confused with true confidential data. For example, use the name “FIRSTNAME1 LASTNAME2” rather than “JOHN SMITH.”

Test data that can be mistaken for real data are sometimes called realistic test data. Such data may be required for some kinds of software testing or validation—for example, software that applies a statistical model to names in an attempt to identify typos or inadvertent repetitions. Provided that the realistic test data are not developed using confidential data or a model based on the confidential data, realistic test data will not compromise the content of confidential data. However, it can be difficult to develop such data, and it can be inadvertently confused with confidential data, potentially causing operational difficulties.

A fully synthetic dataset is a dataset for which there is no one-to-one mapping between data in the original dataset and data in the de-identifed dataset. One approach to creating a fully synthetic dataset is to use the original dataset to create a high-fdelity model – that is, a model with many parameters that is functionally close to the reality that it models – and then to use a simulation to produce individual data elements that are consistent with the model. Special efforts must be taken to maintain marginal and joint probabilities when creating partially or fully synthetic data.

Fully synthetic datasets cannot provide more information to the downstream user than was contained in the original model. Nevertheless, some users may prefer to work with the fully synthetic dataset instead of the model for a variety of reasons:

Because of the possibility of false discovery, analysts should be able to validate their dis-coveries against the original data to ensure that the things they discover are in the original data and not artifacts of the data generation process.

Both high-fdelity models and synthetic data generated from models may leak personal information that is potentially re-identifable. The amount of leakage can be controlled us-ing formal privacy models (e.g., differential privacy) that typically involve the introduction of noise. Section 4.4.7 describes the construction of fully synthetic data with differential privacy.

There are several advantages for agencies that choose to release de-identifed data as a fully synthetic dataset:

Fully synthetic data also have these disadvantages and limitations:

In addition, it can be extremely challenging to construct the high-fdelity models that enable good synthetic datasets. The best known techniques for constructing these models are designed around ensuring that specifc properties of the data (e.g., correlations between certain data attributes) are preserved. Models constructed this way may not necessarily refect other properties that were present in the original data.

It is often possible to construct very high-fdelity models when the desirable properties of the synthetic data are known in advance (e.g., when it is known what questions future analysts will want to answer using the synthetic data) or when using modern deep learn-ing techniques. Constructing synthetic data that faithfully represent all properties of the original data while enforcing strong privacy guarantees is impossible.

Agencies that share or publish synthetic data can optionally provide a verifcation service that takes queries or algorithms developed with synthetic data and applies them to actual data. The results of these queries or algorithms can then be compared with the results of running the same queries on the synthetic data, and the researchers can be warned if the results are signifcantly different. Alternatively, results can be provided to the researchers after the application of additional statistical disclosure limitation.

Releases of synthetic data can be confusing to the lay public.

A growing number of mathematical algorithms have been developed for creating syn-thetic datasets that meet the mathematical defnition of privacy provided by differential privacy [53]. Most of these algorithms will transform a dataset that contains private data into a new dataset containing synthetic data that provides reasonably accurate results in re-sponse to a variety of queries. However, there is no algorithm or implementation currently in existence that can be used by a person who is unskilled in the area of differential privacy. This is an area of active research.

When ε is set appropriately, differential privacy limits the privacy loss that a data subject experiences from the use of their private data to the maximum privacy loss necessary for a given statistical purpose. Note that this particular notion of privacy does not protect all secrets about a person. It only protects the secrets that an observer would not have been able to learn if the person’s data were not present in the dataset. Stated another way, differential privacy protects individuals from additional harm that may result from their participation in the data analysis but does not protect them from harm that would have occurred even if their data were not present. For example, if a study concludes that residents of Vermont overwhelmingly drive 4-wheel-drive vehicles, one might conclude that a particular Vermonter drives a 4-wheel-drive vehicle even if that individual did not participate in the study. Differential privacy does not attempt to prevent inferences of this type.

Many academic papers on differential privacy assume a value of 1.0 for ε but do not explain the rationale of the choice. Some researchers who work in the field of differential privacy have tried mapping existing privacy regulations to the choice of ε, but these efforts invariably result in values of ε ≠ 1. Principled approaches for setting ε are a subject of current academic research [93, 93, 92, 104].

There are relatively few scholarly publications regarding the deployment of differential privacy in real-world situations, and there are few papers that provide guidance on choosing appropriate values of ε. Thus, agencies that are interested in using differential privacy algorithms to allow for the querying of sensitive datasets or the creation of synthetic data should ensure that the techniques are appropriately implemented and that the privacy protections are appropriate for the desired application. Tools area now under development to help visualize and understand the error and risks associated with different privacy parameters.

Despite these difficulties, differential privacy has been successfully used in a growing number of real-world deployments, including the Census Bureau’s OnTheMap interactive tool, the 2020 Census, and the College Scorecard website developed by the Internal Revenue Service and the U.S. Department of Education.

For additional information, please see the NIST Differential Privacy blog series at https://www.nist.gov/itl/applied-cybersecurity/privacy-engineering/collaboration-space/focus-areas/de-id/dp-blog, and the NIST de-identification tool location at https://www.nist.gov/itl/applied-cybersecurity/privacy-engineering/collaboration-space/focus-areas/de-id/tools.

Another model for granting public access to de-identifed agency information is to construct an interactive query interface that allows members of the public or qualifed investigators to run queries over the agency’s dataset. This option has been developed by several agencies, and there are many ways that it can be implemented. For example:

A significant privacy risk with interactive queries is that each query results in additional privacy loss [44].³⁶ That is, the query interface alone will not protect privacy but should be combined with additional privacy protections. For example, query interfaces should incorporate privacy mechanisms, such as adding noise to results with differential privacy, and log both queries and query results in order to deter and detect malicious use.

When formal privacy is desired, an advantage of synthetic data is that the privacy loss budget can be spent on creating the synthetic dataset rather than on responding to interactive queries. This approach can also result in consistent query results for all users of the query interface.

Agencies should validate datasets after they are de-identifed to ensure that the resulting dataset meets the agency’s goals in terms of both data usefulness and privacy protection.

De-identification can decrease the usefulness of the resulting dataset. It is, therefore, important to ensure that the de-identified dataset is still useful for the intended application. Otherwise, there is no reason to go through the expense of de-identification and added risk of releasing the de-identified data.

There are several approaches to validating data usefulness. For example, insiders can perform statistical calculations on both the original dataset and the de-identifed dataset and compare the results to see if the de-identifcation resulted in unacceptable changes. Agencies can engage trusted outsiders to examine the de-identifed dataset and determine whether the data could be used for the intended purpose.

Recognizing that there is an inherent trade-off between data accuracy and privacy protection, agencies can adopt accuracy goals for the data that they make available to a broad audience. An accuracy goal specifies how accurate the data must be in order to be fit for an intended use. Limiting data accuracy to this goal is an important technique for protecting the privacy of data subjects.

There are several approaches to validating the privacy protection provided by de-identifcation, including:

Ideally, studies should report re-identifcation results for such motivated intruder tests for both vulnerable populations and the general population.

These approaches do not provide provable guarantees on the protection offered by formal privacy techniques, but they may be useful as part of an overall agency risk assessment.³⁷ Applications that require provable privacy guarantees should rely on formal privacy meth-ods, such as differential privacy, when planning their data releases.

Validating the privacy protection of de-identifed data is greatly simplifed by using vali-dated de-identifcation software, as discussed in Sec. 5, “Re-Identifcation Studies.”

Re-identifcation studies are motivated intruder tests. These studies can identify issues that would allow external actors to successfully re-identify de-identifed data. Re-identifcation studies look for vulnerabilities in a dataset that could be used for re-identifying data sub-jects. They do not determine whether someone with intimate knowledge of a specifc re-spondent can fnd that respondent in the database. The only way to protect a single specifc individual perceived to be at high risk of re-identifcation is through data perturbation (e.g., noise addition) or information reduction (e.g., removing the observation altogether).

The key statistic calculated in re-identifcation studies is the conditional re-identifcation rate. This statistic is a proxy for disclosure risk. The rate is the number of confrmed links between the dataset and another dataset divided by the number of putative (suspected) links expressed as a percentage. If the conditional re-identifcation rate falls above an agreed upon threshold for any publication strata, it suggests that the data should not be released outside of a controlled environment.

Re-identifcation studies are often an iterative process. If a re-identifcation study uncovers problems with the de-identifed data, the data curator can engage with subject-matter ex-perts, make changes to the dataset, and perform another re-identifcation study. Changes to the dataset might involve coarsening linking variables, eliminating highly disclosive link-ing variables from the microdata to be released, or coarsening strata. This continues until the study concludes that the de-identifed data can be disseminated.

There are broadly two types of re-identifcation studies:

Formal privacy parameters often appear opaque and elusive to non-theoreticians. Subject-matter experts and decision-makers more clearly understand disclosure risk after reviewing the results of re-identifcation studies.

External intruders may attempt to calculate for themselves re-identifcation rates as part of an academic review of the agency’s work. They may even purport to have successfully linked their external data to a de-identifed dataset. However, external intruders do not have access to the confdential data on which the de-identifed data were based, so there is no way for the external intruders to validate their work: the calculations may be low or high, and the linkages may be correct or incorrect. By conducting a re-identifcation study a priori, those who seek to disseminate the de-identifed data know how successful the external intruder’s re-identifcation attempt was if both parties have access to the same external internal data.

The conditional re-identifcation rate is identical to the metric of precision in the record linkage and health science literature. It represents the ratio of true positives to the sum of true positives and false positives. Data owners should not be alarmed if an external organization reports a relatively high suspected re-identifcation rate as long as they know that the conditional re-identifcation rate is low [59, 77, 139].

Confrmed re-identifcation rates are defned in Sec. 3.2.1 as re-identifcation probabilities. On its own, a low confrmed re-identifcation probability does not indicate that an organiza-tion should disseminate a de-identifed dataset. Even when a confrmed rate is low, a high conditional rate should direct an organization to not disseminate the de-identifed micro-data.

Re-identifcation studies may identify problems that can direct improvements to any or-ganization’s disclosure avoidance methods. Re-identifcation studies are not designed to replace legacy or modern provable privacy methods but to act as a quality control to vali-date that the methods – old and new – protect as they were designed.

Agencies should clearly defne the requirements for de-identifcation algorithms and the software that implements those algorithms. They should be sure that the algorithms that they intend to use are validated, that the software implements the algorithms as expected, and that the data that result from the operation of the software are correct.

Today, there a growing number of algorithms and tools for performing de-identifcation, data masking, and other privacy-preserving operations. NIST maintains a list of some of these tools³⁸. Such tools are also increasingly being evaluated in academic litera-ture [144] and by NIST [135, 1]. Although there are no widely accepted performance standards or certifcation procedures at present, NIST is conducting a series of Collabo-rative Challenges “designed to spur research, innovation, and understanding of data dei-dentifcation techniques.” Details of the NIST Collaborative Challenges program can be found at https://www.nist.gov/itl/applied-cybersecurity/privacy-engineering/collaboration-space/challenges/collaborative-0.

Software evaluation should begin with a determination of the privacy preserving techniques used by the software. The agency should determine that the algorithm is appropriate for the task at hand and that it has not been superseded by a new algorithm or approach that provides a more appropriate risk/utility trade-off.

There have been decades of research in the feld of statistical disclosure limitation and de-identifcation, and understanding in the feld has evolved over time. Agencies should not base their technical evaluation of a technique solely on the fact that the technique has been published in peer-reviewed literature or that the agency has a long history of using the technique and has not experienced any problems. Instead, it is necessary to evaluate proposed techniques through the totality of scientifc experience and with regard to current threats.

Traditional statistical disclosure limitation and de-identifcation techniques base their risk assessments – in part – on an expectation of what kinds of data are available to a data intruder to conduct a linkage attack. Where possible, these assumptions should be docu-mented and published along with a description of the privacy-preserving techniques that were used to transform the datasets prior to release so that they can be reviewed by external experts and the scientifc community.

Because our understanding of privacy technology and the capabilities of privacy attacks are rapidly evolving, techniques that have been previously established should be periodically reviewed. New vulnerabilities may be discovered in techniques that have been previously accepted. Alternatively, new techniques may be developed that allow agencies to reevaluate the trade-offs they have made with respect to privacy risk and data usability.

A de-identifcation tool is a program that is involved in the creation of de-identifed datasets.

De-identifcation tools may perform many functions, including:

De-identifcation tools may handle a variety of data modalities. For example, tools may be designed for tabular data or for multimedia. Tools may attempt to de-identify all data types or be developed for specifc modalities. A potential risk of using de-identifcation tools is that a tool could be equipped to handle some but not all of the different modalities in a dataset. For example, a tool could de-identify the categorical information in a table according to a de-identifcation standard but might not detect or attempt to address the presence of identifying information in a text feld. For this reason, de-identifcation tools should be validated for the specifc kinds of data that the agency intends to use.

Output fles created by de-identifcation tools and data masking tools can record provenance information, such as metadata regarding input datasets, the de-identifcation methods used, and the resulting decrease in data accuracy. Output fles can also be explicitly marked to in-dicate that they have been de-identifed. For example, de-identifcation profles that are part of the Digital Imaging and Communications in Medicine (DICOM) specifcation indicate which elements are direct versus quasi-identifers and which de-identifcation algorithms have been employed [43, Appendix E, “Attribute Confdentiality Profles”].

Data masking tools are programs that can remove or replace designated felds in a dataset while maintaining relationships between tables. These tools can be used to remove direct identifers but generally cannot identify or modify quasi-identifers in a manner consistent with a privacy policy or risk analysis.

Data masking tools were developed to allow software developers and testers access to datasets that contain realistic test data while providing minimal privacy protection. Absent additional controls or data manipulations, data masking tools should not be used for the de-identifcation of datasets that are intended for public release nor as the sole mechanism to ensure confdentiality in non-public data sharing.

Once techniques are evaluated and approved, agencies should ensure that the techniques are faithfully executed by their chosen software. Privacy software evaluation should consider the trade-off between data usability and privacy protection. Privacy software evaluation should also seek to detect and minimize the chances of tool error and user error.

For example, agencies should verify:

Agencies should also evaluate the performance of the de-identifcation software, such as:

Ideally, software should be able to track the accumulated privacy leakage from multiple data releases.

The feld of statistical disclosure limitation (SDL) has developed approaches for gauging the impact of SDL techniques on microdata [172]. The literature examines the mathe-matical impact of SDL procedures (e.g., sampling, recoding, suppression, rounding, and noise addition) and computes the possible impact on various statistical measurements. A growing body of evidence indicates the need for agencies to evaluate the accuracy of the de-identifed data to verify that the accuracy is suffcient for the intended use.

For example:

Approaches for evaluating data accuracy include [91]:

Agencies can create or adopt standards regarding the accuracy of de-identifed data. If data accuracy cannot be well-maintained along with data privacy goals, then the release of data that are inaccurate for statistical analyses could potentially result in incorrect scientifc conclusions and incorrect policy decisions.

Government agencies can use de-identifcation technology to make datasets available to researchers and the public while minimizing the compromise of privacy of the people con-tained within the data.

There are currently three primary models available for de-identifcation:

These models can be mixed within a single dataset to provide different kinds of access for different users or intended uses.

Privacy protection can be strengthened when agencies employ formal models for privacy protection, such as differential privacy, because the mathematical models that these sys-tems use are designed to ensure privacy protection irrespective of future data releases or developments in re-identifcation technology. However, the mathematics underlying these systems is very new, and there is little experience within the Government in using these systems. Thus, agencies should understand the implications of these systems before de-ploying them in place of traditional de-identifcation approaches that do not offer formal privacy guarantees.

Agencies that use de-identifcation should establish appropriate governance structures to support de-identifcation, data release, and post-release monitoring. Such structures will typically include a Disclosure Review Board as well as appropriate education, training, and research efforts.

A summary of this document’s advice for practitioners appears in Figure 5.

In closing, it is important to remember that different jurisdictions may have different stan-dards and policies regarding the defnition and use of de-identifed data. Information that is considered de-identifed in one jurisdiction may be regarded as being identifable in an-other.

Governance and Management (Section 3) Managing de-identifcation includes identify-ing the goals of the de-identifcation process and considering risks to participants in the data release. To guide this process, this document describes several tools:

Technical Steps (Section 4) The technical process of de-identification should leverage the best practices developed over the past several decades. In particular, NIST recommends that agencies:

Software (Section 5) In general, agencies should:

Fig. 5. Advice for Practitioners: A Summary

[1] July 27, 2020. URL: https://www.nist.gov/blogs/cybersecurity-insights/differential-privacy-privacy-preserving-data-analysis-introduction-our.

[2] 115th Congress (2017–2018). Public Law 115-435: The Foundations for Evidence-Based Policymaking Act of 2018. 2018. URL: https://www.congress.gov/bill/115th-congress/house-bill/4174.

[3] 45 CFR 164 Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule Safe Harbor method Standard: De-identificationof protected health information.

[4] 81 FR 49689: Revision of OMB Circular No. A-130, “Managing Information as a Strategic Resource. July 28, 2016. URL: https://www.cio.gov/policies-and-priorities/circular-a-130/.

[5] 95th Congress. Public Law 95-416. Oct. 5, 1978. URL: https://www.census.gov/history/pdf/NARA_Legislation.pdf.

[6] John Abowd et al. “The 2020 Census Disclosure Avoidance System TopDown Algorithm”. In: Harvard Data Science Review Special Issue 2 (June 24, 2022). URL: https://hdsr.mitpress.mit.edu/pub/7evz361i.

[7] John M. Abowd and Michael B.Hawes. “Confidentiality Protection in the 2020 US Census of Population and Housing”. In: Annual Review of Statistics and Its Application 10.1 (2023). DOI: 10.1146/annurev-statistics-010422-034226. URL: https://doi.org/10.1146/annurev-statistics-010422-034226.

[8] John M. Abowd and Ian M. Schmutte. Economic Analysis and Statistical Disclosure Limitation. Mar. 19, 2015. URL: https://www.brookings.edu/bpea-articles/economic-analysis-and-statistical-disclosure-limitation/.

[9] John M. Abowd and Lars Vilhuber. “How Protective are Synthetic Data?” In: Lecture Notes in Computer Science: Privacy in Statistical Databases 5262 (2008), pp. 239–246. URL: https://link.springer.com/chapter/10.1007/978-3-540-87471-3_20.

[10] Charu C. Aggarwal. “On K-Anonymity and the Curse of Dimensionality”. In: Proceedings of the 31st International Conference on Very Large Data Bases. VLDB ’05. Trondheim, Norway: VLDB Endowment, 2005, pp. 901–909. ISBN: 1595931546.

[11] J. Trent Alexander, Michael Davern, and Betsey Stevenson. “Inaccurate age and sex data in the census PUMS files: Evidence and implications”. In: Public Opinion Quarterly 74 (3 2010), pp. 551–569. URL: https://doi.org/10.1093/poq/nfq033.

[12] Micah Altman et al. “Towards a Modern Approach to Privacy-Aware Government Data Releases”. In: Berkeley Technology Law Journal 30 (3), pp. 1967–2072. URL:

http://papers.ssrn.com/sol3/papers.cfm?abstract id=2779266.

[13] AMD. AMD Secure Encrypted Virtualization (SEV). Last accessed July 13, 2022.

[14] Olivia Angiuli, Joe Blitzstein, and Jim Waldo. “How to De-Identify Your Data”. In: Commun. ACM 58.12 (Nov. 2015), pp. 48–55. ISSN: 0001-0782. DOI: 10.1145/

[15] Luk Arbuckle. “Aggregated data provides a false sense of security”. In: Privacy Tech (Apr. 27, 2020).

[16] Luk Arbuckle and Felix Ritchie. “The Five Safes of Risk-Based Anonymization”. In: IEEE Security & Privacy 17.5 (2019), pp. 84–89. DOI: 10.1109/MSEC.2019.

2929282.

[17] ASTM International. ASTM E1869-04 (Reapproved 2014) Standard Guide for Confidentiality, Privacy, Access, and Data Security Principles for Health Information Including Electronic Health Records. 2014.

[18] Daniel Barth-Jones. The ‘Re-Identification’ of Governor William Weld’s Medical Information: A Critical Re-Examination of Health Data Identification Risks and Privacy Protections, Then and Now. July 2012. URL: https://ssrn.com/abstract=2076397%20or%20http://dx.doi.org/10.2139/ssrn.2076397.

[19] Hans T Bjornsson et al. “Intra-individual Change Over Time in DNA Methylation with Familial Clustering”. In: JAMA 299 (24 June 25, 2008), pp. 2877–2833. URL:

https://pubmed.ncbi.nlm.nih.gov/18577732/.

[20] Kaitlin Boeckl, ed. NIST Privacy Risk Assessment Methodology (PRAM). Jan. 16,

[21] Janice Branson et al. “Evaluating the re-identification risk of a clinical study report anonymized under EMA Policy 0070 and Health Canada Regulations”. In: Trials 21.1 (Feb. 18, 2020), p. 200. DOI: 10 . 1186 / s13063 - 020 - 4120 - y. URL: https :

//doi.org/10.1186/s13063-020-4120-y.

[22] Sean Brooks et al. An introduction to privacy engineering and risk management in federal systems. Gaithersburg, MD, 2017. DOI: 10.6028/NIST.IR.8062. URL:

https://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8062.pdf.

[23] Mark Bun and Thomas Steinke. “Concentrated Differential Privacy: Simplifications, Extensions, and Lower Bounds”. In: CoRR abs/1605.02065 (2016). arXiv:

[24] Sylvia M. Burwell. Open Data Policy-Managing Information as an Asset. May 9,

[25] George Bush. Executive Order 13402:Strengthening Federal Efforts to Protect Against Identity Theft. May 10, 2006. URL: https://www.gpo.gov/fdsys/pkg/FR-2006-05-15/pdf/06-4552.pdf.

[26] G. Camarillo, C. Holmberg, and Y. Gao. Re-INVITE and Target-Refresh Request Handling in the Session Initiation Protocol (SIP). RFC 6141 (Proposed Standard). Internet Engineering Task Force, Mar. 2011. URL: www.ietf.org/rfc/rfc6141.txt.

[27] David Carrell et al. “Hiding in plain sight: Use of realistic surrogates to reduce exposure of protected health information in clinical text”. In: Journal of the American Medical Informatics Association : JAMIA 20 (2 July 2012), pp. 342–348. DOI:

10.1136/amiajnl-2012-001034.

[28] Ann Cavoukian. Privacy by Design: The 7 Foundational Principles. Ontario, CA, Jan. 2011. URL: https://www.ipc.on.ca/wp-content/uploads/Resources/7foundationalprinciples.pdf.

[29] Census Bureau Data Stewardship Program. DS025: Organization of the Disclosure Review Board. Dec. 19, 2019. URL: https://www2.census.gov/foia/ds_policies/ds025.pdf.

[30] Malcolm Chisholm. “7 Phases of a Data Life Cycle”. In: Information Management (July 9, 2015). URL: http://www.information-management.com/news/data-management/Data-Life-Cycle-Defined-10027232-1.html.

[31] A. Church. “A Note on the ‘Entscheidungsproblem’”. In: Journal of Symbolic Logic 1 (1936), pp. 40–41.

[32] Aloni Cohen. “Attacks on Deidentification’s Defenses”. In: 31st USENIX Security Symposium (USENIX Security 22). Boston, MA: USENIX Association, Aug. 2022, pp. 1469–1486. ISBN: 978-1-939133-31-1. URL: https://www.usenix.org/conference/usenixsecurity22/presentation/cohen.

[33] Aloni Cohen and Kobbi Nissim. “Towards formalizing the GDPR’s notion of singling out”. In: Proceedings of the National Academy of Sciences 117.15 (2020), pp. 8344–8352. DOI: 10.1073/pnas.1914598117. eprint: https://www.pnas.org/doi/pdf/10.1073/pnas.1914598117. URL: https://www.pnas.org/doi/abs/10.1073/pnas.1914598117.

1914598117.

[34] Commission on Evidence-Based Policymaking. The Promise of Evidence-Based Policymaking. Sept. 2017. URL: https://www.acf.hhs.gov/opre/project/commission-evidence-based-policymaking-cep.

[35] Donna Daily. “Disclosure Avoidance Protections for the American Community Survey”. In: Random Samplings (Dec. 14, 2022). URL: https://www.census.gov/newsroom/blogs/random-samplings/2022/12/disclosure-avoidance-protections-acs.html.

[36] Tore Dalenius. “Finding a needle in a haystack – or identifying anonymous census records”. In: Journal of Offcial Statistics 2 (3 1986), pp. 329–336.

[37] Tore Dalenius. “Finding a Needle in a Haystack, or Identifying Anonymous Census Records”. In: Journal of Official Statistics 2 (3 1986), pp. 329–336.

[38] Tore Dalenius. “Towards a methodology for statistical disclosure control”. In: Statistik Tidskrift 15 (1977), pp. 429–444.

[39] Jon P. Daries et al. “Privacy, Anonymity, and Big Data in the Social Sciences”. In: Communications of the ACM 57 (6 Sept. 2014), pp. 56–63.

[40] Data Protection Toolkit: Report and Resources on Statistical Disclosure Limitation Methodology and Tiered Data Access (formerly “Statistical Policy Working Paper #22”), rev. 2022.01. Nov. 28, 2022. URL: https://nces.ed.gov/fcsm/dpt.

[41] Tess DeBlanc-Knowles et al. National Strategy to Advance Privacy-Preserving Data Sharing and Analytics. Mar. 2023. URL: https://www.whitehouse.gov/wp-content/uploads/2023/03/National-Strategy-to-Advance-Privacy-Preserving-Data-Sharing-and-Analytics.pdf.

[42] Tanvi Desai, Felix Ritchie, and Richard Welpton. Economics Working Paper Series 1601. 2016. URL: http://dx.doi.org/10.13140/RG.2.1.3661.1604.

[43] DICOM Standards Committee. DICOM PS3.15 2016e — Security and System Management Profiles. 2016. URL: http://dicom.nema.org/medical/dicom/current/output/html/part15.html#chapter_E.

[44] Irit Dinur and Kobbi Nissim. “Revealing Information While Preserving Privacy”. In: Proceedings of the Twenty-second ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems. PODS ’03. San Diego, California: ACM, 2003, pp. 202–210. ISBN: 1-58113-670-6. DOI: 10.1145/773153.773173. URL: doi.acm.org/10.1145/773153.773173.

[45] Changyu Dong, Liqun Chen, and Zikai Wen. “When Private Set Intersection Meets Big Data: An Efficient and Scalable Protocol”. In: Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security. CCS ’13. Berlin, Germany: Association for Computing Machinery, 2013, pp. 789–800. ISBN: 9781450324779. DOI: 10.1145/2508859.2516701. URL: https://doi.org/10.1145/2508859.2516701.

[46] Jörg Drechsler, Stefan Bender, and Susanne Rässler. Comparing fully and partially synthetic datasets for statistical disclosure control in the German IAB Establishment Panel (Working paper 11). New York, 2007. URL: http://fdz.iab.de/342/section.aspx/Publikation/k080530j05.

[47] George T. Duncan, Mark Elliot, and Juan-José Salazar-Gonzalez. Statistical Confidentiality: Principles and Practice. Springer, 2011, p. 113.

[48] I. Dunsford et al. “A human blood-group chimera”. In: British Medical Journal 81 (July 11, 1953). URL: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2028470/.

[49] Cynthia Dwork. “Differential Privacy”. In: 33rd International Colloquium on Automata, Languages and Programming, part II (ICALP 2006). Vol. 4052. Lecture Notes in Computer Science. Springer Verlag, July 2006, pp. 1–12. ISBN: 3-540-35907-9. URL: https://www.microsoft.com/en-us/research/publication/differential-privacy/.

[50] Cynthia Dwork and Moni Naor. “On the Difficulties of Disclosure Prevention in Statistical Databases or The Case for Differential Privacy”. In: Journal of Privacy and Confidentiality 2.1 (Sept. 2010), pp. 93–107. DOI: 10.29012/jpc.v2i1.585. URL: https://journalprivacyconfidentiality.org/index.php/jpc/article/view/585.

[51] Cynthia Dwork and Aaron Roth. “The Algorithmic Foundations of Differential Privacy”. In: Foundations and Trends in Theoretical Computer Science. Vol. 9. 3–4.

NOW, 2014, pp. 211–407.

[52] Cynthia Dwork et al. “Calibrating Noise to Sensitivity in Private Data Analysis”. In: Theory of Cryptography. Ed. by Shai Halevi and Tal Rabin. Berlin, Heidelberg: Springer Berlin Heidelberg, 2006, pp. 265–284. ISBN: 978-3-540-32732-5.

[53] Cynthia Dwork et al. “Calibrating Noise to Sensitivity in Private Data Analysis”. In: Proceedings of the Third Conference on Theory of Cryptography. TCC’06. New York, NY: Springer-Verlag, 2006, pp. 265–284. ISBN: 3540327312. DOI: 10.1007/11681878_14. URL: doi.org/10.1007/11681878_14.

[54] Department of Education (ED) Disclosure Review Board (DRB). The Data Disclosure Decision. Version 1.0. 2015. URL: https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/1151/2016/10/The-Data-Disclosure-Decision-Department-of-Education-Case-Study_Mar-2015.pdf.

[55] M J. Elliot and A. Dale. Scenarios of attack: the data intruder’s perspective on statistical disclosure risk. English. 1999.

[56] Mark Elliot, Elaine Mackey, and Kieron O’Hara. The Anonymisation Decision-Making Framework: European Practitioners’ Guide. Oxford Road, Manchester, UK: UKAN, University of Manchester, 2020. URL: https://ukanon.net/framework/.

[57] El Emam. Methods for the de-identification of electronic health records for genomic research. 2011. URL: https://genomemedicine.biomedcentral.com/articles/10.

1186/gm239.

[58] K. El Emam and B. Malin. “Appendix B: Concepts and Methods for De-Identifying Clinical Trial Data”. In: Sharing Clinical Trial Data: Maximizing Benefits, Minimizing Risk. Washington, DC: Institute of Medicine of the National Academies, The National Academies Press, 2015.

[59] Khaled El Emam and Luk Arbuckle. Anonymizing Health Data: Case Studies and Methods to Get you Started. Sebastopol, CA: O’Reilly Media, 2013.

[60] Ali Farzanehfar, Florimond Houssiau, and Yves-Alexandre de Montjoye. “The risk of re-identification remains high even in country-scale location datasets”. In: Patterns 2.3 (2021), p. 100204. ISSN: 2666-3899. DOI: https://doi.org/10.1016/j.patter.2021.100204. URL: https://www.sciencedirect.com/science/article/pii/S2666389921000143.

[61] I. P. Fellegi. “On the Question of Statistical Confidentiality”. In: Journal of the American Statistical Association 67.337 (1972), pp. 7–18. DOI: 10.1080/01621459.1972.10481199.

1972.10481199.

[62] Matthew Fredrikson et al. “Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing”. In: 23rd USENIX Security Symposium. San Diego, CA, Aug. 20, 2014. URL: https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-fredrikson-privacy.pdf.

[63] Matthew Fredrikson et al. “Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing”. In: Proceedings of the 23rd USENIX Conference on Security Symposium. SEC’14. San Diego, CA: USENIX Association, 2014, pp. 17–32. ISBN: 9781931971157.

[64] Katherine L. Frohlich and Louise Potvin. “Transcending the known in public health practice: the inequality paradox: the population approach and vulnerable populations”. In: Am J Public Health 98 (2 Feb. 2008), pp. 216–21. DOI: 10.2105/AJPH.

2007.114777.

[65] Simson Garfinkel. De-Identification of Personally Identifiable Information. Tech. rep. NIST IR 8053. National Institute of Science and Technology, Nov. 2015. URL: http://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.8053.pdf.

[66] Simson L. Garfinkel. De-identification of personal information. 2015. DOI: 10.6028/NIST.IR.8053. URL: https://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.8053.pdf.

[67] Simson L. Garfinkel. Government Data De-Identification Stakeholder’s Meeting June 29, 2016 Meeting Report. 2016. DOI: 10.6028/NIST.IR.8150. URL: https://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.8150.pdf.

[68] Genetics Home Reference. What are single nucleotide polymorphisms (SNPs)? Last access June 16, 2022. 2022. URL: https://ghr.nlm.nih.gov/primer/genomicresearch/snp.

[69] Genetics Home Reference. What is DNA. Last access June 16, 2022. 2022. URL: https://ghr.nlm.nih.gov/primer/basics/dna.

[70] Craig Gentry. “A Fully Homomorphic Encryption Scheme”. AAI3382729. PhD thesis. Stanford, CA, USA, 2009. ISBN: 9781109444506.

[71] Glossary of Statistical Terms. OECD, 2007. URL: https://stats.oecd.org/glossary/detail.asp?ID=4884.

[72] Ruobin Gong, Erica L. Groshen, and Salil Vadhan. “Harnessing the Known Unknowns: Differential Privacy and the 2020 Census”. In: Harvard Data Science Review Special Issue 2 (June 24, 2022). URL: https://hdsr.mitpress.mit.edu/pub/fgyf5cne.

[73] E. Green and F. Richie. “Data Access Project: Final Report”. In: (June 2016). URL: https://eprints.uwe.ac.uk/31874.

[74] Melissa Gymrek et al. “Identifying Personal Genomes by Surname Inference”. In:

Science 339 (6117 Jan. 2013), pp. 321–329.

[75] Michael Hawes. The Census Bureau’s Simulated Reconstruction-Abetted Re-identification Attack on the 2010 Census. May 7, 2021. URL: https://www.census.gov/data/academy/webinars/2021/disclosure-avoidance-series/simulated-reconstruction-abetted-re-identification-attack-on-the-2010-census.html.

[76] Michael B. Hawes. “Implementing Differential Privacy: Seven Lessons From the 2020 United States Census”. In: Harvard Data Science Review 2.2 (Apr. 30, 2020).

[77] TN Herzog, FJ Scheuren, and WE Winkler. Data Quality and Record Linkage Techniques. New York/London: Springer, 2007.

[78] IHE IT Infrastructure Technical Committee. IHE IT Infrastructure Handbook. June 6, 2014. URL: https://www.ihe.net/wp-content/uploads/uploadedFiles/Documents/ITI/IHE_ITI_Handbook_De-Identification_Rev1.1_2014-06-06.pdf.

[79] IHE IT Infrastructure Technical Committee. IHE IT Infrastructure Handbook: De-Identification. Integrating the Healthcare Enterprise, Mar. 14, 2014. URL: https://ihe.net/uploadedFiles/Documents/ITI/IHE_ITI_Handbook_De-Identification_Rev1.0_2014-03-14.pdf.

[80] Clay Johnson III. OMB Memorandum M-07-16: Safeguarding Against and Responding to the Breach of Personally Identifiable Information. Replaced by M-17-12. May 2007. URL: https://georgewbush-whitehouse.archives.gov/omb/memoranda/fy2007/m07-16.pdf.

[81] Information Commissioner’s Office. Anonymisation: code of practice, managing data protection risk. 2012. URL: https://ico.org.uk/media/1061/anonymisation-code.pdf.

[82] ISO. ISO/IEC 27559:2022 — Information security, cybersecurity and privacy protection — Privacy enhancing data de-identification framework. 2022. URL: https://www.iso.org/standard/71677.html.

[83] ISO 26324:2012, Information and documentation – Digital object identifier system. Geneva, Switzerland, 2012. URL: https://www.iso.org/standard/43506.html.

[84] ISO/IEC 24760-1:2011, Information technology – Security techniques – A framework for identity management – Part 1: Terminology and concepts. 2011.

[85] ISO/TS 25237:2008(E) Health Informatics — Pseudonymization. Geneva, Switzerland, 2008.

[86] Auguste Kerckhoffs. “II. Desiderata De La Cryptographie Militaire”. In: Journal des sciences militaires IX (Jan. 1883), pp. 5–38.

[87] Shehab Khan. ““Human chimera”: Man fails paternity test because genes in his saliva are different to those in sperm”. In: The Independent (Oct. 24, 2015).

[88] Daniel Kifer et al. “Bayesian and Frequentist Semantics for Common Variations of Differential Privacy: Applications to the 2020 Census”. In: arXiv preprint arXiv:2209.03310 (2022).

[89] Vladimir Kolesnikov et al. “Efficient Batched Oblivious PRF with Applications to Private Set Intersection”. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. CCS ’16. Vienna, Austria: Association for Computing Machinery, 2016, pp. 818–829. ISBN: 9781450341394. DOI: 10.1145/2976749.2978381. URL: https://doi.org/10.1145/2976749.2978381.

[90] Leah Krehling. De-Identification Guideline. Tech. rep. WL-2020-01. Department of Electrical and Computer Engineering, Western University, 2020, p. 45.

[91] Sandra Lechner and Winfried Pohlmeier. “To Blank or Not to Blank? A Comparison of the Effects of Disclosure Limitation Methods on Nonlinear Regression Estimates”. In: Privacy in Statistical Databases, Lecture Notes in Computer Science 3050 (2004), pp. 187–200.

[92] Jaewoo Lee and Chris Clifton. “Differential Identifiability”. In: Proceedings of the 18th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. KDD ’12. Beijing, China: Association for Computing Machinery, 2012, pp. 1041–1049. ISBN: 9781450314626. DOI: 10.1145/2339530.2339695. URL: https://doi.org/10.1145/2339530.2339695.

[94] Ninghui Li, Tiancheng Li, and Suresh Venkatasubramanian. “t-Closeness: Privacy Beyond k-Anonymity and l-Diversity”. In: 2007 IEEE 23rd International Conference on Data Engineering. 2007, pp. 106–115. DOI: 10.1109/ICDE.2007.367856.

[95] Yehuda Lindell. “Secure Multiparty Computation”. In: Commun. ACM 64.1 (Dec. 2020), pp. 86–96. ISSN: 0001-0782. DOI: 10.1145/3387108. URL: https://doi.org/10.1145/3387108.

[96] Roderick JA Little. “Statistical analysis of masked data”. In: Journal of Official Statistics 9 (2 1993), pp. 407–426.

[97] M. Altman M et al. “Towards a Modern Approach to Privacy-Aware Government Data Release”. In: Berkeley Journal of Technology Law Internet (2016). URL: https://lawcat.berkeley.edu/record/1127405?ln=en.

[98] Ashwin Machanavajjhala et al. “l-diversity: Privacy beyond k-anonymity”. In: Proc.

22nd Intnl. Conf. Data Engg. (ICDE). 2006.

[99] Ashwin Machanavajjhala et al. “Privacy: Theory meets Practice on the Map”. In: 2008 IEEE 24th International Conference on Data Engineering. 2008, pp. 277–286. DOI: 10.1109/ICDE.2008.4497436.

[100] Management and Budget Office. Statistical Policy Directive No. 1: Fundamental Responsibilities of Federal Statistical Agencies and Recognized Statistical Units. Dec. 2, 2014. URL: https://www.federalregister.gov/documents/2014/12/02/2014-28326/statistical-policy-directive-no-1-fundamental-responsibilities-of-federal-statistical-agencies-and.

[101] Sean Martin. When De-identifying Patient Information, Follow the HITRUST Framework. Sept. 8, 2016. URL: https://hitrustalliance.net/de-identifying-patient-information-follow-hitrust-framework/.

[102] Daniel A. Mayer et al. “Implementation and Performance Evaluation of Privacy-Preserving Fair Reconciliation Protocols on Ordered Sets”. In: Proceedings of the First ACM Conference on Data and Application Security and Privacy. CODASPY ’11. San Antonio, TX, USA: Association for Computing Machinery, 2011, pp. 109–120. ISBN: 9781450304665. DOI: 10.1145/1943513.1943529. URL: https://doi.org/10.1145/1943513.1943529.

[103] E McCallister, T Grance, and K A Scarfone. Guide to protecting the confidentiality of Personally Identifiable Information (PII). Gaithersburg, MD, 2010. DOI: 10.6028/NIST.SP.800-122. URL: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf.

[104] Luise Mehner, Saskia Nuñez von Voigt, and Florian Tschorsch. “Towards Explaining Epsilon: A Worst-Case Study of Differential Privacy Risks”. In: 2021 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). 2021, pp. 328–331. DOI: 10.1109/EuroSPW54576.2021.00041.

[105] William K. Michener et al. “Participatory design of DataONE—Enabling cyber-infrastructure for the biological and environmental sciences”. In: Ecological Informatics 11 (2012). Data platforms in integrative biodiversity research, pp. 5–15. ISSN: 1574-9541. DOI: https://doi.org/10.1016/j.ecoinf.2011.08.007. URL: https://www.sciencedirect.com/science/article/pii/S1574954111000768.

[106] Yves-Alexandre de Montjoye et al. “Unique in the Crowd: The Privacy Bounds of Human Mobility”. In: Nature Scientific Reports 3 (1376 2013).

[107] Yves-Alexandre de Montjoye et al. “Unique in the Shopping Mall: On the Reidentifiability of Credit Card Metadata”. In: Science 347 (536 2015).

[108] Arvind Narayanan and Ed Felten. No silver bullet: De-identification still doesn’t work. Working Paper. July 9, 2014. URL: http://randomwalker.info/publications/no-silver-bullet-de-identification.pdf.

[109] Arvind Narayanan and Vitaly Shmatikov. “Robust De-anonymization of Large Sparse Datasets”. In: 2008 IEEE Symposium on Security and Privacy (sp 2008). 2008, pp. 111–125. DOI: 10.1109/SP.2008.33.

[110] National Center for Environmental Health. Planning for an Emergency: Strategies for Identifying and Engaging At-Risk Groups. Centers for Disease Control, 2015. URL: https://www.cdc.gov/nceh/hsb/disaster/atriskguidance.pdf.

[111] National COVID Cohort Collaborative. N3C Privacy-Preserving Record Linkage. Last accessed February 18, 2023. 2023. URL: https://covid.cd2h.org/PPRL.

[112] NIST Big Data Interoperability Framework: Volume 1, Definitions. 2015. DOI: 10.6028/NIST.SP.1500-1. URL: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1500-1.pdf.

[113] NIST Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0. Gaithersburg, MD, 2022. DOI: 10.6028/NIST.CSWP.10. URL: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf.

[114] Christine M. O’Keefe and James O. Chipperfield. “A Summary of Attack Methods and Confidentiality Protection Measures for Fully Automated Remote Analysis Systems”. In: International Statistical Review / Revue Internationale de Statistique 81.3 (2013), pp. 426–455. ISSN: 03067734, 17515823. URL: http://www.jstor.org/stable/43299645 (visited on 06/28/2022).

[115] Barack Obama. Executive Order 13642—Making Open and Machine Readable the New Default for Government Information. May 9, 2013. URL: https://obamawhitehouse.archives.gov/the-press-office/2013/05/09/executive-order-making-open-and-machine-readable-new-default-government-.

[116] OECD Director of Public Governance. OECD Open, Useful and Re-usable data (OURdata) Index: 2019. 2020. URL: https://www.oecd.org/gov/digital-government/ourdata-index-policy-paper-2020.pdf.

[117] OECD Legal Instruments. Recommendation of the Council on Health Data Governance. Dec. 12, 2016. URL: https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0433.

[118] Office of Civil Rights, US Department of Health and Human Services. Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. Nov. 26, 2012. URL: http://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/.

[119] Office of Civil Rights, US Department of Health and Human Services. Individuals’ Right under HIPAA to Access their Health Information 45 CFR § 164.524. Last accessed June 17, 2022. 2022. URL: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.

[120] Office of Management and Budget. Circular A110 Revised 11/19/93, as further amended 9/30/99. URL: https://obamawhitehouse.archives.gov/omb/circulars_a110/.

[121] Office of Management and Budget. Statistical Programs and Standards. 2022. URL: https://www.whitehouse.gov/omb/information-regulatory-affairs/statistical-programs-standards/.

[122] Office of Safeguards, US Internal Revenue Service. Publication 1075: Tax Information Security Guidelines For Federal, State and Local Agencies. 2021. URL: https://www.irs.gov/pub/irs-pdf/p1075.pdf.

[123] Paul Ohm. “Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization”. In: UCLA Law Review 57 (July 13, 2012), pp. 1701–1778.

[124] OHRP-Guidance on Research Involving Private Information or Biological Specimens. Aug. 16, 2008. URL: http://www.hhs.gov/ohrp/policy/cdebiol.html.

[125] Joanne Pascale and Thomas Mayer. “Alternative Methods for Exploring Confidentiality Issues Related to Dependent Interviewing”. In: (Dec. 11, 2002).

[126] Joanne Pascale et al. Issue Paper on Disclosure Review for Information Products with Qualitative Research Findings. Mar. 2, 2020. URL: https://www.census.gov/library/working-papers/2020/adrm/rsm2020-01.html.