Paljastatavus

Paljastatavus is an Estonian term describing the susceptibility that information or a system's state can be disclosed to unauthorized parties. In information security and privacy research, paljastatavus denotes the potential for personal data, system details, or other sensitive information to become known. It encompasses both direct disclosure (identifiers such as names or IDs) and indirect disclosure (inferences from released data). The term derives from paljastama "to reveal" and the suffix -tavus, indicating a characteristic or quality.

In practice, paljastatavus is used as a risk indicator in privacy impact assessments and data protection analyses. It is assessed qualitatively and quantitatively, considering data attributes, linkability, and adversary capabilities. Concepts related to paljastatavus include disclosure risk, re-identification risk, and information inference.

Mitigation strategies aim to reduce paljastatavus: data minimization, pseudonymization or anonymization, encryption, access controls, and governance measures; privacy-enhancing technologies such as differential privacy or data perturbation may also reduce paljastatavus. The concept is aligned with European privacy standards, including GDPR, which emphasize limiting data disclosure and protecting data subjects.

Examples: A public dataset containing direct identifiers has high paljastatavus. Even after removing names, if birth year, ZIP code, and gender are present, re-identification risk may remain, sustaining paljastatavus. Properly designed privacy safeguards reduce paljastatavus to acceptable levels.

See also: privacy, data protection, disclosure risk, re-identification, anonymization.