De-identification
By Gareth HoyleLast updated How we research
De-identification is the process of removing or altering information that identifies people in a dataset, so records cannot readily be linked to individuals.
De-identification is any process of removing the association between a set of identifying data and the person it describes, which is how NIST defines it. In practice that means removing or transforming direct identifiers (names, email addresses, account numbers) and indirect identifiers (job titles, dates, locations).
How does US law define de-identification?
US law sets de-identification standards in specific statutes. The HIPAA Privacy Rule, at 45 CFR 164.514(b), allows two methods: Expert Determination that the risk of identification is very small, or Safe Harbor removal of 18 listed identifiers. HHS says de-identified health information is no longer protected health information.
The CCPA, at California Civil Code section 1798.140(m), treats information as deidentified only if the business takes reasonable measures, publicly commits not to re-identify it and contractually binds recipients to the same terms. Deidentified information is excluded from the CCPA's definition of personal information.
How does UK law treat de-identification?
UK law has no defined de-identification standard, so under UK GDPR the result is either anonymous information outside the law or pseudonymized personal data inside it, as the ICO's anonymization guidance explains.
Our vetting requires a documented method and a re-identification test on a sample. See de-identification for AI training data.