Instructor: De-identification. 2 2
Now, in a previous lesson 3 3
I mentioned the concept 4 4
of de-identification when we're talking about privacy. 5 5
In this lesson, we're going to dig a little bit deeper into it. 6 6
When I'm talking about de-identification 7 7
this is the methods 8 8
and technologies that remove identifying information 9 9
from data before we distribute that data. 10 10
Now, the real benefit of de-identification here 11 11
is to be able to take data that may be protected by privacy. 12 12
And once we do the de-identification 13 13
that data now becomes usable by us again for other purposes. 14 14
Now, this doesn't violate anybody's privacy 15 15
because we are de-identifying the data. 16 16
Oftentimes, your de-identification 17 17
is going to be implemented 18 18
as part of your database design. 19 19
Now, there are lots of different things that we have to talk 20 20
about when we talk about de-identification. 21 21
This includes things like data masking, tokenization 22 22
aggregation, and banding, and re-identification. 23 23
Now, when we talk about data masking, this is 24 24
where a de-identification method is used where a generic 25 25
or placeholder label is substituted in 26 26
for real data while preserving the structure 27 27
or format of the original data. 28 28
So let's say you're going to gimme all your credit cards. 29 29
I take all your credit cards 30 30
and I take away all of the information from your 16 digits 31 31
and I put XXXX in front of all those 16 digits. 32 32
That would mask the data. 33 33
Nobody would be able to identify that credit card anymore 34 34
as yours because we don't have the credit card. 35 35
We just have XXXX. 36 36
That's a form of data masking. 37 37
So really, when we talk about data masking, we are covering 38 38
up the data, or maybe I have a database of all my customers 39 39
and for some reason we collected social security numbers. 40 40
We would never do that. 41 41
But let's say we did. 42 42
Well, that's a nine digit number. 43 43
Instead of having your unique social security number 44 44
I might go back through the database 45 45
and change all your social security numbers 46 46
to 111 111 111. 47 47
And by doing that, I have now genericized it 48 48
across all my students to have the same number. 49 49
It keeps the same format, it keeps the same structure 50 50
but it doesn't actually take any personal information 51 51
from you because I've erased that social security number. 52 52
The next one we have is what's known as tokenization. 53 53
Now, this is a de-identification method where 54 54
a unique token is substituted in for real data. 55 55
Now, when you do tokenization, one 56 56
of the things you have to worry about is 57 57
if you have the ability to go back and be reversible. 58 58
And usually with tokenization it is. 59 59
So again, let's say I had your social security numbers. 60 60
Instead of changing them all to one 61 61
I assign a random number to each of my students. 62 62
That's now their student ID. 63 63
That student ID is now substituted in for that 64 64
social security number field. 65 65
But I might have a master list in my safe that says 66 66
this student ID matches this social security number. 67 67
That's what we're talking about with tokenization. 68 68
We're using another number to represent the information. 69 69
So if any of my staff go 70 70
into the database and look at your social security number 71 71
they would just see the made up student number. 72 72
They wouldn't get your real social security number 73 73
because that's stored in my vault. 74 74
But if I had some real business case where I needed it 75 75
I could then do the matching 76 76
and then re-identify you that way. 77 77
So it's a little bit more dangerous to do tokenization. 78 78
The next one we want to talk about is aggregation and banding. 79 79
Now, aggregation and banding is where you de-identify people 80 80
by gathering the data 81 81
and generalizing it to protect the individuals involved. 82 82
So if we were using aggregation and banding 83 83
we might take all of our subjects in a medical trial 84 84
and instead of identifying them 85 85
as the person or the subject number, we would say 86 86
out of the 100 people who participated in this trial 87 87
90% of them didn't have side effects. 88 88
Now, that doesn't mean any 89 89
of those 90 quickly identifies as you. 90 90
It just means somebody didn't have side effects. 91 91
It's one of those 90. 92 92
And if we knew that you didn't have side effects 93 93
well you're just one of 90. 94 94
We don't know you individually 95 95
and that's where we're able to protect your privacy. 96 96
Now, let me give you another example 97 97
of the dangers of some of these things 98 98
and when you have to think about de-identification 99 99
in terms of when somebody tries to re-identify people. 100 100
So let's say that I went 101 101
and did a corporate survey of my company. 102 102
We went ahead and we sent 103 103
out a survey to everybody and we say 104 104
don't tell us your name because we don't want to identify you. 105 105
We want you to feel comfortable giving us 106 106
your honest feedback. 107 107
And we ask 'em a whole bunch of questions about the company. 108 108
How do you like it here? 109 109
Is the pay competitive? 110 110
Do you enjoy your job? 111 111
Do you like helping the students? 112 112
All that kind of stuff. 113 113
But then on the final question 114 114
we ask something like, what is your age? 115 115
What is your sex? 116 116
Are you married or not? 117 117
And we get that kind of information. 118 118
So, okay, that seems innocuous enough because we 119 119
didn't ask for things like your social security number 120 120
or your employee ID or your name. 121 121
So we still shouldn't be able to identify you. 122 122
So we take all the results of the survey 123 123
we shuffle 'em all together 124 124
and we start reading through 'em. 125 125
This one's a five star. 126 126
This one's a five star. 127 127
This is a four and a half star. 128 128
This one's a one. 129 129
Hmm, well, now I'm upset. 130 130
I want to know who this one is, right? 131 131
Can't I re-identify them? 132 132
Well, let's say I look at them and I read 133 133
through their comments, and I get to the last page. 134 134
I says, this is a woman. 135 135
This is somebody who's between the ages of 30 and 40. 136 136
This is somebody who is married, huh? 137 137
Well, based on that, and my small staff 138 138
I know that's only one person in my company. 139 139
And so I know the person who thinks Jason's the 140 140
worst boss ever. 141 141
And lo and behold, it's my wife. 142 142
Tamara went and filled out the survey 143 143
and leaves me a one star review. 144 144
Thanks, honey. 145 145
You know, this is the kind of stuff that happens. 146 146
But again 147 147
if you have this where you can re-identify somebody 148 148
then all that anonymization doesn't really help. 149 149
Now, why does this happen? 150 150
Well, because we're a small company, we only have 10 people. 151 151
And so if we ask a question like that on the last page 152 152
and we don't be honest, but if we did, it would be very easy 153 153
for me to identify because we only have a handful 154 154
of employees, we have 10 people. 155 155
And so if I ask things like 10 year age bands, like, are you 156 156
between 20 and 30, 30 and 40, 40 and 50? 157 157
And if you're a male or female and if you're married or not 158 158
that tells me pretty much I can identify everybody down 159 159
based on that result. 160 160
And so that would take away the ability 161 161
of having that de-identification. 162 162
So this is the concept of re-identification, right? 163 163
Re-identification is an attack that combines de-identified 164 164
data sets and with other data sources, things that you 165 165
know to discover how secure the de-identification method is. 166 166
And so if we use that system in our company 167 167
that would not be secure. 168 168
Now, if I used that same system in my last job 169 169
where I worked with 400 other people, 170 170
it would've been very secure 171 171
Because there was a lot more people who might have 172 172
been a woman who was married between 30 and 40 years old. 173 173
And so it'd be very easy for them to hide 174 174
in the bulk out of those 400 people of that company. 175 175
That probably signifies about 50 or 60 people. 176 176
And so I wouldn't be able to identify you 177 177
individually asking those questions. 178 178
So when you're building out surveys and when you're building 179 179
out systems to have a de-identification in place 180 180
you need to think these things 181 181
through because sometimes something that seems 182 182
like it would work because it works at a large company 183 183
won't work at a small company or vice versa.