Re-identification Risk

Re-identification risk is the chance that a record which no longer carries a name or identifier can still be linked back to a person, through precise location and time, rare characteristics, the structure of repeated records, or combination with other available data. It is a property of a specific release in a specific context: the same file can be low-risk as a monthly aggregate and high-risk as trip-level rows.

Ordinary fields become identifiers in combination

In a fictional transit dataset where card identifiers were replaced by stable codes, one code boards at stop 41 at 05:52 every weekday, alights beside the regional hospital, and returns at 19:40. No field names anyone, yet the code links those trips into one trail, and a neighbour or employer who knows the person may recognize the pattern; a staff roster may support the guess without proving it. Remove the code as well and the trips become unlinked events that are much harder to attribute, though a rare stop-and-time combination can still be tied to a person by someone who observed it.

Direct identifiers are the easy part. The hard part is the combination of ordinary fields, the rarity of some values, and the other datasets a recipient can reach. Assess the risk for the recipients and context of the actual release, not for an imagined attacker with no other information.

Reduce, then check, then choose a release model

Reduce detail by aggregating, coarsening time and place, dropping rare attributes, or suppressing small groups, then check what remains. There is no universal minimum count that makes a group safe; a threshold is a judgment for this release, and a group of one is a warning to examine, since whether it exposes someone depends on linkability and on what the published attributes reveal. Suppression alone is not enough: published totals, overlapping tables, and earlier versions can restore a hidden cell, so check the whole set of releases together. Synthetic data needs a disclosure-risk assessment beyond confirming that no real record was copied, because a generator can still reveal who was in the source or what a sensitive attribute is likely to be. NIST’s guidance on de-identifying government datasets recommends studying the re-identification risk of the specific dataset and choosing among release models: publishing de-identified data, releasing synthetic data, offering a query interface, or sharing inside a controlled environment, with a review board over the decision.

Masking removes or hides part of what a reader sees; pseudonymization replaces identifiers but keeps records linkable; encryption protects stored or transmitted data from people without the key and hides nothing from those who have it. Each reduces a specific exposure and leaves others in place, and none of them is anonymization. Anonymization is a claim about the outcome of an assessment, not the name of a transformation. Record the residual risk that remains and who accepted it.

Reference: NIST SP 800-188: De-Identifying Government Datasets. Examples here are illustrative.