Other meanings of De-identification
DATA PRIVACY
De-identification is the process of removing or obscuring personally identifying information from data so that individuals are not readily identifiable. It can support research, statistics, and data sharing, but it does not always eliminate privacy risk: linkage with other datasets, rare attributes, or auxiliary information may permit re-identification.1
De-identification reduces the connection between data and the person described by the data. Common operations include removing names, addresses, telephone numbers, account numbers, and other direct identifiers; generalizing dates or locations; suppressing rare records; and replacing identifiers with coded values. The resulting dataset may still contain useful information for epidemiology, public policy, business analysis, or machine learning.
De-identification is distinct from simple redaction. A dataset can omit names yet remain identifying when it contains a distinctive combination of age, occupation, diagnosis, and location. The National Institute of Standards and Technology describes de-identification as a risk-management activity rather than a guarantee that identity can never be discovered.2 Its practical objective is to make identification sufficiently difficult in relation to the data's intended use, available safeguards, and likely adversaries.
Two principal methods are recognized for protected health information under the U.S. Health Insurance Portability and Accountability Act (HIPAA). Safe Harbor requires removal of 18 categories of identifiers, including names, geographic details smaller than a state in most cases, dates tied to an individual, contact details, biometric identifiers, and full-face photographs.1 Expert determination instead requires a qualified specialist to assess the probability that the information could identify a person.
Technical methods include masking, aggregation, generalization, pseudonymization, tokenization, and statistical perturbation. Pseudonymization replaces an identifier with a code but preserves a separate re-identification key; it therefore remains personal-data processing under the General Data Protection Regulation when a person can still be identified by reasonably available means.3 Differential privacy takes a different approach by adding mathematically calibrated randomness to query results or published statistics, limiting what an observer can learn about any one record.4
De-identification lowers risk but cannot guarantee anonymity in every setting. Re-identification may occur when supposedly anonymous records are joined with voter files, public registers, social-media information, or another dataset containing overlapping attributes. Small populations, unusual medical conditions, precise timestamps, and detailed movement trails are especially difficult to protect. A 2019 study of mobility data demonstrated that a few spatiotemporal points can uniquely distinguish many individuals, illustrating why location data require particular care.5
Sound governance combines technical transformation with access controls, contractual limits, monitoring, retention schedules, and incident response. Organizations should define the threat model, evaluate singling out and linkability, test plausible linkage attacks, document residual risk, and reassess the data when new external datasets or analytical techniques appear. Data minimization and purpose limitation remain relevant even after identifiers have been removed.
Some of the hardest records to de-identify are not conventional databases. Free-text clinical notes can reveal identity through names, workplaces, family relationships, or narrative events, while images, voice recordings, genomic sequences, and device telemetry may carry identifying signals that are not obvious in a spreadsheet. Genomic data are particularly challenging because a person's sequence is inherently distinctive and can also reveal information about relatives; removal of names alone does not make a genomic dataset anonymous.6
De-identification can also reduce analytical value. Coarsening age, geography, or dates may weaken the ability to study disparities, outbreaks, or rare diseases, creating a tension between privacy and utility. Synthetic data can help by generating artificial records with selected statistical properties, but it is not automatically safe: memorization or overly faithful reproduction can disclose information. The most defensible practice is therefore contextual: choose a method and release environment together, validate both privacy and usefulness, and retain only the detail necessary for the stated purpose.
De-identification is context-dependent: legal definitions, acceptable risk thresholds, and required safeguards vary by jurisdiction, dataset, and intended use.
Help improve the encyclopedia. Reports go straight to the site manager.