Consumers Anonymous? The Privacy Risks of De-Identified and Aggregated Consumer Data

This page has been archived on the Web

Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.

Archived

This page has been archived on the Web.

Organization

Public Interest Advocacy Centre

Published

2011

Summary

Private sector companies may aggregate personal information about their customers for internal purposes and analysis and some companies may sell their aggregated data for profit. Other companies’ business models are founded on combining various sets of aggregated data with sets of publicly available information to produce valuable data sets that help companies make predictions about customers and better target customers or engage in “data mining” practices. When data is aggregated, organizations often claim that they anonymize data such that it no longer fits within the definition of “personal information” under PIPEDA.

However, several researchers have recently shown that de-identified data is often not very anonymous and pieces of data can easily be re-identified or “reattached” to information about an identifiable person. This practice of re-identification is problematic because oftentimes consumers do not realize that the commercial bartering of their personal information is a burgeoning and profitable industry.

As organizations collect an increasing amount of personal information about consumers, their practices of de-identifying this personal information should be scrutinized to ensure that the data has been de-identified to a sufficient degree to protect the consumer from re-identification and potential harms that could flow from the use of de-identified data. Industry best practices regarding de-identification and anonymization would serve to bring increased transparency to garner consumer trust in personal information practices.

De-identified data and the questions around re-identification are growth industries. Given the potential harms to consumers and citizens, the OPC must monitor this question closely and provide timely guidance to industry - and comfort to consumers - to assure all parties they are aware of how individuals are or may become identifiable in the course of regular commercial data processing.

This document is available in the following language(s):

English only

• English (PDF document)

OPC Funded Project

This project received funding support through the Office of the Privacy Commissioner of Canada’s Contributions Program. The opinions expressed in the summary and report(s) are those of the authors and do not necessarily reflect those of the Office of the Privacy Commissioner of Canada. Summaries have been provided by the project authors. Please note that the projects appear in their language of origin.

Contact Information

Email: piac@piac.ca
Website: http://www.piac.ca/information/contact_piac
Tel: (613) 562-4002