Not so anonymous

A recent article in The New York Times drew my attention to a study which shows how "anonymized" information is, in fact, not so anonymous after all. In the paper "How To Break Anonymity of the Netflix Prize Dataset" two researchers show how to identify users of the Netflix movie rental service from an anonymized dataset released to participants in a data mining competition organized by Netflix.

The interesting thing about this study is that, according to Netflix "The anonymity of the information is comparable to the strictest federal standards for anonymizing personal health information." While this may or may not be true, it is certainly true that there is a debate going on as to whether the privacy regulations are sufficient (and not only in the US, but also in Europe).

The problem is the following: on one hand the data collected by the medical industry (as well as other industries) is very valuable for data analysis (data mining), and can be a powerful tool in medical research. On the other hand the data is very sensitive, and should be protected. Law makers are faced with the problem of coming up with data protection laws which, on one hand, allows researchers to use the data, but on the other hand protects the privacy of the citizens.