[boron1006]

Absolutely idiotic article and title. Obviously it's possible to reidentify a person if you have 15 demographic attributes if you don't specify which attributes you use. I can do even better, I can reidentify 100% of people, with only their name, DOB, fingerprints and SSN. The fact that DOB and zip code are in the dataset make this result completely trivial.

A couple years ago, I got into an argument on reddit where someone claimed that any mapping could be recovered "using deep learning techniques" (e.g. if you take 3*0 = 0, you can get back that the original value was 3 with no other information except for the value "0"), and that obviously I was just too stupid to understand deep learning if I couldn't see that.

[AnthonyMouse]

I mean, yes, some people are factually incorrect. But I think the general idea is more like, if you have a massively over-determined system of linear equations, you can omit many of the values and still be able to recover them all from the remaining values and knowledge of the equations.

And it's not intuitively obvious which combinations of values allow you to recover which other ones.

[boron1006]

For context, this was when ISPs were planning on selling data, and someone was collecting donations saying they'd reidentify senators internet history. I said that people shouldn't donate to them, because it wasn't even clear what the ISPs would release. Their point was it doesn't matter what the ISPs release, they could reidentify anyone with deep learning.

> And it's not intuitively obvious which combinations of values allow you to recover which other ones.

I think it's pretty intuitive that Zip Code and DOB are identifiers. That's why they count as such in HIPAA, and are used to demonstrate identity by governments, credit cards, etc.

Personally I think this stuff just poisons the well when it comes to discussions of privacy. I think the goal is to remove the expectation of anonymity by claiming that it's never possible.

[singron]

> I think it's pretty intuitive that Zip Code and DOB are identifiers.

It's great that you think that, but basically no company uses that definition. Most company privacy policies don't consider combinations of information when making this determination. E.g. your billing address might be personal information, but your zip code by itself might not. Similarly, IP address (with or without last octet), wifi SSID, location data, browsing history (or attributes derived from browsing history), and so on. Each individual piece of data isn't enough to personally identify you, so the privacy policy often doesn't have to be applied to it.

E.g. after reading the Google privacy policy[0], can you tell what protections your zip code and DOB have? Will Google treat them as personal information or personal identifiers or not?

0: https://policies.google.com/privacy?hl=en-US

[AnthonyMouse]

> I think it's pretty intuitive that Zip Code and DOB are identifiers.

Sure, but what about job title? What about job title when someone's job title is "mayor" or "fire chief" and it's possible to deduce from other information what city they're in? Or someone's job title is just "Governor of the State of California"?

Any collection of random independent characteristics become uniquely identifying once you have enough of them. Then all the attackers need is another database with the same characteristics that also includes names or other identifiers, and you can associate the missing fields from one database with the other.

> Personally I think this stuff just poisons the well when it comes to discussions of privacy. I think the goal is to remove the expectation of anonymity by claiming that it's never possible.

It's not that it's never possible, it's that it's only possible if we don't feed these centralized databases enough information to uniquely identify people. So we need to stop doing that.

[nixpulvis]

Oof, that doesn't even really surprise me given the way people talk about deep learning and other ML ideas.

On a related note, while x * 0 effectively erases knowledge of x, something like x ⊕ s, where s is some secret, reversibly obscures it.

The notion of reversibility is the key misunderstanding.

[eccbits]

It’s a serious paper by serious people — the headline may oversimplify, as headlines often do, but the fundamental point is right on: deidentifucation is very hard.