Re-identification risk

An assessment examines direct and indirect identifiers, rare patterns, linkage sources, and who might attempt identification. It can test plausible matching methods and consider how access controls affect exposure. NIST’s de-identification guidance discusses measurable standards, review processes, and re-identification studies.

Risk changes when new information becomes available or data is shared with a wider audience. Keeping assumptions and limitations in the documentation supports reassessment instead of treating an earlier transformation as permanent proof of safety.

Licensing can give a new recipient access to both the dataset and other information useful for linkage. Review should consider that recipient’s environment, proposed uses, onward sharing, and restrictions on identification. These controls complement, rather than replace, appropriate data transformations.

Fictional example: A dataset contains an unusual sequence of service visits without names. A matching public account of the same sequence could reveal the customer. The provider evaluates whether to generalize dates, suppress the rare sequence, or limit the release setting.

A failed identification attempt does not prove that no method could succeed. No single risk metric covers every disclosure scenario, and legal anonymity standards differ. Assertions should explain the assessed context and residual uncertainty.