Image by Author

When organizations share or publish data, they typically remove names, addresses, and other obvious identifiers first. The assumption is that once those fields are gone, the data is safe. But removing identifiers doesn’t eliminate the possibility that someone could trace the data back to specific individuals. That possibility has a name: re-identification risk. Understanding what it is, how it’s measured, and why it matters is one of the first steps in taking statistical privacy seriously. For broader context on how organizations attempt to protect data before it’s shared, this introduction to data anonymization is a useful starting point.

Key Definitions

Re-identification is the process of linking anonymized or de-identified records back to specific individuals. It typically works by combining the released dataset with external information, such as publicly available records, social media activity, or location data.

Re-identification risk is the probability that a record in a dataset can be matched back to the individual it describes. It isn’t a fixed number. Risk varies by record, by dataset, and by what external information an attacker might reasonably access.

Quasi-identifiers are data fields that aren’t directly identifying on their own but become identifying in combination. Age, ZIP code, sex, and occupation are common examples. None of these reveals a name. Together, they often narrow a dataset down to a single person.

Linkage attack is the method most often used to re-identify individuals. An attacker takes a field or combination of fields from the anonymized dataset and matches them against a second, external dataset to find a unique overlap.

How Re-identification Risk Works

Re-identification risk isn’t a binary outcome. It exists on a spectrum, and every dataset carries some level of it. The question isn’t whether a dataset could theoretically be re-identified, but how likely that is given what an attacker could realistically access.

Several factors push that risk higher.

Dataset granularity. The more precise the data, the easier re-identification becomes. An exact birth date is more identifying than a birth year. A precise GPS coordinate is more identifying than a city name. Every increase in specificity raises the risk.

Record uniqueness. Within any dataset, some individuals are harder to conceal. A 94-year-old woman living in a rural ZIP code is statistically rare. Even with names removed, her record may be the only one of its kind in the dataset. Rare combinations of attributes consistently carry higher re-identification risk than common ones.

External data availability. Risk doesn’t live in a single dataset. It depends on what other data exists and how easily it can be accessed. Voter registration files, social media profiles, and commercial data brokers all represent sources an attacker might use to cross-reference a released dataset. As more personal data becomes publicly available, the baseline re-identification risk for any given dataset increases alongside it.

Dataset size. Counterintuitively, very small datasets often carry higher per-record risk. With fewer records, unusual combinations of attributes are more likely to be unique, giving an attacker fewer candidates to narrow down.

Researchers measure re-identification risk using several approaches. One common method calculates the percentage of records in a dataset that are unique across all quasi-identifier fields. Another estimates risk based on the size of the equivalence class each record belongs to, meaning how many other records share the same combination of quasi-identifier values. A record shared with nine others represents lower risk than one shared with none. A dataset where most records belong to large equivalence classes offers substantially better protection than one full of rare attribute combinations.

A Practical Example

The most cited demonstration of re-identification risk comes from researcher Latanya Sweeney, whose work in the late 1990s showed that roughly 87% of Americans could be uniquely identified using just three fields: date of birth, sex, and five-digit ZIP code. No names, no account numbers, just those three attributes.

This finding had a lasting effect on how privacy researchers think about risk. It demonstrated that de-identified data isn’t the same as truly anonymous data, and that the combination of seemingly harmless fields can be far more identifying than any single field alone.

A similar principle applies to almost any dataset. A hospital that releases patient records with names removed but retains diagnosis codes, admission dates, and ZIP codes may believe it has adequately protected its patients. But someone who also has access to local news archives, insurance records, or social media posts may be able to match enough attributes to identify specific individuals.

Re-identification risk doesn’t require sophisticated tools or privileged access. In many documented cases, it has been accomplished with freely available public records and basic matching logic.

Conclusion

Re-identification risk is the gap between data that looks anonymous and data that actually is. Closing that gap requires more than stripping identifiers. It requires understanding which combinations of remaining fields could make individual records unique, and measuring that risk before a dataset is released rather than after.