Identifikabilitet

Identifikabilitet, or identifiability, is the degree to which a person can be identified from data or information. It depends on the content of the data, the context in which it is used, and the tools available for identification. Direct identifiers such as names, addresses, or social security numbers clearly increase identifiability, while quasi-identifiers—like age, gender, ZIP code, or employment—can, in combination with other datasets, enable re-identification.

Identifiability is central in privacy, research ethics, and data protection. In European data protection law, personal data are any information relating to an identified or identifiable natural person, where identifiability depends on the means reasonably likely to be used to identify the person, considering technology, costs and time. The degree of identifiability can change as new data sources or techniques emerge.

De-identification attempts to remove or obscure identifiability, but the level of risk must be assessed. Anonymization aims to make re-identification practically impossible, after which the data are no longer personal data. Pseudonymization replaces identifying fields with substitutes but allows re-linking with the right key, so the data remain personal data.

Techniques to reduce identifiability include data minimization, generalization and suppression (as in k-anonymity, l-diversity, t-closeness), and, increasingly, formal privacy methods such as differential privacy. Practical assessment often uses risk scoring or data protection impact assessments.

Identifiability is a moving target, influenced by data linkage potential, background information, and computational advances. Organizations must balance data utility with privacy risk and apply appropriate safeguards based on the context and legal requirements.