Big Data and the application of anonymization techniques Annual Privacy Forum 2015 7-8 October, Luxembourg Giuseppe D’Acquisto Garante per la protezione dei dati personali 1
The concept of anonymization My data 1 D.O.F Any person Empty 2
Anonymization is a relative concept Biometrics/Health Location IDs My data This data is less anonymous This data is more anonymous This data is less anonymous This data is more anonymous 3 Any person
Anonymization is absolute from legal perspective This This is is not personal personal data data 4
The anonymization approach in the U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA) This is not This is personal data personal data 5
The anonymization approach in the WP29 Opinion Biometrics/Health Location IDs My data This is personal data 1) Three privacy risks This is not 2) Reasonable effort test personal data 6 Any person
Engineering may not be enough Biometrics/Health Location IDs My data This is After engineering personal data This is not personal Gap to fill with data policies 7 Any person
Safeguards Biometrics/Health Location IDs First processing My data in This is compliance personal data This is not After Anonymization If the data is personal in the data personal sphere (the device), then art. 5(3) applies 8 Any person
Additional safeguards Biometrics/Health Location IDs My data This is personal data Only personal data This is not After anonymization If access rights have personal to be granted, data data cannot be anonymized 9 Any person
On the re-use of data Biometrics/Health Location IDs My data This is personal data Non incompatibility • of purposes Art 7(a) user friendly • This is not Art 7(f) engineered • Anonymization as personal Engineering • a compatible information data further purpose 10 Any person
Conclusions There is room for privacy principles also in Big Data New tools for safeguarding data subjects Policy – Technology – Probability/Information theory – The key is the capability to deal with complexity: anonymization is difficult (but not impossible)… …but, bad anonymization is very easy ( AoL 2006 – Netflix 2009 - NY taxis 2014) 11
Thank you very much g.dacquisto@gpdp.it 12
Recommend
More recommend