Anonymisation

Anonymisation is a security measure designed to remove or obscure identifiers in data, making it impossible to trace the information back to, for example, a specific individual. This is particularly important for organizations that work with personal data, such as healthcare institutions, banks, and companies that handle sensitive personal information.

By anonymising data, you protect it against unauthorized access and misuse, which in turn reduces the risk of identity theft, data breaches, and other serious consequences. Additionally, anonymisation can be an essential part of an organization's GDPR compliance, which mandates that all organizations protect personal data.

Implementing Anonymisation

To anonymise data, it is first necessary to identify and classify the data that needs to be anonymised. This involves assessing which data constitutes personal information and determining how sensitive that information is. For example, patient records at a hospital may contain health information, which is considered sensitive personal data, whereas customer details from a store are typically ordinary personal data. This classification is crucial in choosing the most appropriate anonymisation technique.

There are various methods of anonymisation, each with its own advantages and disadvantages. The choice of technique depends on the nature of the data and the desired level of anonymity.

Suppression

This method involves the direct removal of data fields that can be used to identify individuals. Examples include names, addresses, or unique ID numbers. While suppression is an effective way to eliminate the risk of identification, it can also significantly reduce the utility of the data if many fields are removed.

Generalization

Generalization works by reducing the precision of the data, replacing specific values with broader categories. For instance, an exact age like "27" might be replaced with an interval such as "20-30", or a specific address could be generalised to a postal code. This technique maintains the analytical value of the data while lowering the risk of identification.

Anatomization

With anatomization, data is split into two separate databases or datasets for privacy protection. One database contains information that can identify an individual, such as names and addresses, while the other holds sensitive information, like health data. These databases are not directly connected, and there is no key that can link the data from one to the other.

This method is effective when you want to use data about the same individual for different, independent purposes without linking the data together. For example, contact details can be used for sending messages, while health data is analysed separately for statistical purposes. However, since there is no option to link the databases, the data cannot be combined. This is a significant limitation of anatomization.

If you instead wish to combine the data later, anatomization is not the right solution. In such cases, pseudonymisation is more suitable because it allows a secure linkage between datasets using a key

Data Masking

Data masking involves replacing information in a dataset with fictitious values that resemble the original data. The purpose is to conceal personal or confidential information while still allowing the data to be used in practice.

This method is often used during system development and testing, where there’s a need for data that mirrors real data without the risk of sharing or exposing sensitive information. For example, a name like "Anders Hansen" might be changed to "Jens Nielsen" or an address such as "Parkvej 12" to "Søndergade 34". The numbers or names still appear realistic, yet they do not reveal any details about the actual individuals.

Perturbation

Perturbation is a technique that anonymises data by adding small, random changes, making it impossible to identify individuals. For instance, a salary figure of "37,255 DKK" might be altered to "37,000 DKK" or "37,500 DKK". These minor adjustments make it difficult to pinpoint an individual based solely on the salary data, while still allowing the data to be used for calculating averages or identifying overall trends.

This technique only functions as a method of anonymisation if the altered data cannot be linked with other sources containing the original data or related information about an individual. If it's possible to compare the altered data with other details about the person, the anonymity can be compromised. Therefore, perturbation is best suited for analyses of general patterns in the data. It’s important to consider whether the dataset could be combined with other information before choosing perturbation as a secure method.

Once the anonymisation is complete, it is crucial to validate whether it has indeed rendered it impossible to identify individuals. This involves thoroughly checking if the data can be linked to persons—both on its own and when combined with other sources. If identification is still possible, the data are not truly anonymised, and the process needs to be repeated.

Documentation is also essential. Be sure to describe the methods used, the specific parameters, and the results of the validation. This is not only necessary for verifying the anonymisation process but also serves as an important part of your GDPR documentation.

The choice of anonymisation technique always depends on the nature of the dataset, its intended use, and the desired balance between anonymity and data usability. By combining the appropriate methods and ensuring proper implementation, you can achieve both robust data protection and maintain the analytical value of the data

Threat Scenarios

Anonymisation protects against several threats that may be identified in your risk assessment. Without anonymisation, the data are vulnerable to: