reidentifiable

Reidentifiable describes data or datasets from which individuals can be linked back to their real-world identities, despite attempts to remove or obscure direct identifiers. The term is commonly used in data privacy, research ethics, and information security to indicate that de-identified, pseudonymized, or aggregated records nonetheless contain enough unique or linkable characteristics that reidentification is feasible, either directly or probabilistically.

Factors that increase reidentifiability include the presence of quasi-identifiers (e.g., date of birth, zip code), high-dimensional or unique attributes (such as genetic sequences or mobility traces), availability of auxiliary datasets for linkage, and advances in computational methods and machine learning. Well-known incidents, including reidentification of movie ratings and search logs, illustrate how auxiliary information and pattern matching can defeat naive anonymization.

Legal and policy frameworks treat reidentifiable data differently from truly anonymized data. For example, the European Union’s General Data Protection Regulation (GDPR) regards pseudonymized but reidentifiable data as personal data subject to protections, while some national standards specify criteria for de-identification. Risk assessment methods—k-anonymity, l-diversity, differential privacy, and expert determination—are used to measure and reduce reidentifiability. Technical and organizational mitigations include data minimization, aggregation, noise addition, access controls, and legal agreements.

Reidentifiability remains an active area of research and debate, balancing the utility of shared data for innovation and science against individuals’ privacy and the ethical duty to prevent harm from unwanted reidentification.