Page 168 - CyberSecurityEssentialsEnglish

The risk does not come from direct text alone. A combination of age, location, job title, and
medical condition may identify a person even after the name is deleted. This is called re-
identification. Automatic replacement of names is therefore insufficient if rare details or

searchable narratives remain. Guidance on protecting personally identifiable information
stresses that removing direct identifiers is not enough while re-identification remains

possible [4].

TABLE 4-6: LEVELS OF IDENTITY REDUCTION ARE NOT ONE THING
Level What it means What to watch for

Replacing a name or number with a Not full anonymity; the code
Pseudonymizati
code, while re-linking remains map must be kept outside the
on
possible through a separate table. tool.

Removing or reducing the fields
De- Re-identification may remain
that reveal the person directly or
identification possible if the details are rare.
implicitly.

Reducing the possibility of re- Hard in narratives and small
Anonymization identification to a very low level in files, and not achieved by
context. deleting the name alone.

May hide important differences
Using indicators or categories
Aggregation and needs a minimum group
instead of individual records.
size.

Understand the data lifecycle at the tool: where is it sent? Is the conversation retained? Is it

used for improvement or training under the current settings? Who can access it? Is there an
enterprise agreement? Can the data be deleted? The answer may differ between a free
account, an enterprise account, and individual features or connectors.

167