Reidentifikaation

Reidentifikation, commonly written reidentification in English, is the process by which an individual who has been anonymized or de-identified in a data set is identified by linking that data to other information. In privacy and data protection discussions, reidentifikation is a key risk that can undermine the guarantees of anonymity and the confidentiality of personal data.

Reidentifikation can occur when quasi-identifiers or other public data are combined with external data sources to reveal identity. Even seemingly harmless attributes such as date of birth, postal code, or gender can, when cross-referenced with other data, enable reidentifikation, especially in small populations or richly described data sets.

Historical examples illustrate the risk. The 2007 Netflix Prize data set was shown to be de-anonymizable by matching movie ratings with public information, and the 2006 AOL search data release led to reidentification of individual users through query patterns.

Legally and ethically, reidentifikation raises concerns under data protection regimes such as the European Union’s GDPR and the California Consumer Privacy Act (CCPA). Organizations that publish or share data face obligations to minimize reidentifikation risk and to implement privacy-preserving techniques, because de-identified data may still be considered personal data if reidentification is possible.

Mitigation approaches include data minimization, robust anonymization methods, removal or perturbation of quasi-identifiers, and privacy-preserving techniques such as differential privacy, k-anonymity, and l-diversity. However, complete protection against reidentifikation is difficult, and ongoing risk assessment is required as external data sources evolve.