Jason: Privacy Technologies.
In this lesson, we're going to talk about some different
technologies that we use to help ensure
the privacy of our customers.
The first one is de-identification.
When I'm talking about de-identification,
this is the methods and technologies
that remove identifying information from data
before we distribute that data.
Now, the real benefit of de-identification here
is to be able to take data that may be protected by privacy.
And once we do the de-identification,
that data now becomes usable by us again for other purposes.
Now, this doesn't violate anybody's privacy
because we are de-identifying the data.
Oftentimes, your de-identification is going to be implemented
as part of your database design.
Now, there are lots of different things
that we have to talk about
when we talk about de-identification.
This includes things like data masking, tokenization,
aggregation and banding, and re-identification.
Now, when we talk about data masking,
this is where a de-identification method is used
where a generic or placeholder label is substituted in
for real data while preserving the structure
or format of the original data.
So let's say you're going to give me all your credit cards.
I take all your credit cards
and I take away all of the information from your 16 digits
and I put XXXX in front of all those 16 digits.
That would mask the data.
Nobody would be able to identify that credit card anymore
as yours because we don't have the credit card.
We just have XXXXX.
That's a form of data masking.
So really when we talk about data masking,
we are covering up the data,
or maybe I have a database of all my customers
and for some reason,
we collect their social security numbers.
We would never do that, but let's say we did.
Well, that's a nine-digit number.
Instead of having your unique social security number,
I might go back through the database
and change all your social security numbers to 111-11-1111.
And by doing that, I have now genericized it
across all my students to have the same number.
It keeps the same format.
It keeps the same structure,
but it doesn't actually take any personal information
from you because I've erased that social security number.
The next one we have is what's known as tokenization.
Now, this is a de-identification method where a unique token
is substituted in for real data.
Now, when you do tokenization,
one of the things you have to worry about
is if you have the ability to go back and be reversible
and usually with tokenization, it is.
So again, let's say I had your social security numbers.
Instead of changing them all to one,
I assign a random number to each of my students.
That's now their student ID.
That student ID is now substitute in
for that social security number field.
But I might have a master list in my safe
that says this student ID
matches this social security number.
That's what we're talking about with tokenization.
We're using another number to represent the information.
So if any of my staff go into the database
and look at your social security number,
they would just see the made up student number.
They wouldn't get your real social security number
because that's stored in my vault.
But if I had some real business case where I needed it,
I could then do the matching
and then re-identify you that way.
So it's a little bit more dangerous to do tokenization.
The next one we want to talk about is aggregation and banding.
Now, aggregation and banding is where you de-identify people
by gathering the data and generalizing it
to protect the individuals involved.
So if we were using aggregation and banding,
we might take all of our subjects in a medical trial
and instead of identifying them as the person
or the subject number,
we would say out of the 100 people
who participated in this trial,
90% of them didn't have side effects.
Now that doesn't mean any of those 90
quickly identifies as you.
It just means somebody didn't have a side effect.
It's one of those 90.
And if we knew that you didn't have side effects,
well, you're just one of 90.
We don't know you individually.
And that's where we're able to protect your privacy.
Now, let me give you another example of the dangers
of some of these things
and when you have to think about de-identification
in terms of when somebody tries to re-identify people.
So let's say that I went
and did a corporate survey of my company.
We went ahead and we sent out a survey to everybody,
and we said don't tell us your name
because we don't want to identify you.
We want you to feel comfortable
giving us your honest feedback.
And we asked them a whole bunch of questions
about the company.
How do you like it here?
Is the pay competitive?
Do you enjoy your job?
Do you like helping the students?
All that kind of stuff.
But then on the final question we asked something like,
what is your age?
What is your sex?
Are you married or not?
And we get that kind of information.
So okay, that seems innocuous enough because we didn't ask
for things like your social security number
or your employee ID or your name
so we still shouldn't be able to identify you.
So we take all the results of the survey.
We shuffle them all together
and we start reading through them.
This one's a five star, this one's a five star,
this is a four and a half star.
This one's a one.
Hmm, well, now I'm upset.
I want to know who this one is, right?
Can I re-identify them?
Well, let's say I look at them
and I read through their comments
and I get to the last page and it says this is a woman.
This is somebody who's between the ages of 30 and 40.
This is somebody who is married.
Huh, well, based on that and my small staff,
I know that's only one person in my company
and so I know the person
who thinks Jason's the worst boss ever.
And lo and behold, it's my wife.
Tamara went and filled out the survey
and leaves me a one star review.
Thanks, honey.
You know, this is the kind of stuff that happens.
But again, if you have this
where you can re-identify somebody,
then all that anonymization doesn't really help.
Now, why does this happen?
Well, because we're a small company.
We only have 10 people.
And so if we ask a question like that on the last page,
and we don't to be honest, but if we did,
it would be very easy for me to identify it
because we only have a handful of employees.
We have 10 people.
And so if I ask things like 10 year-age bands
like are you between 20 and 30, 30 and 40, 40 and 50
and if you're a male or female
and if you're married or not,
that tells me pretty much I can identify everybody down
based on that result.
And so that would take away the ability
of having that de-identification.
So this is the concept of re-identification, right?
Re-identification is an attack
that combines de-identified data sets
with other data sources, things that you know,
to discover how secure the de-identification method is.
And so if we use that system in our company,
that would not be secure.
Now, if I use that same system in my last job
where I worked with 400 other people,
it would have been very secure
because there was a lot more people
who might have been a woman
who is married between 30 and 40 years old.
And so it'd be very easy for them to hide in the bulk.
Out of those 400 people at that company,
that probably signifies about 50 or 60 people.
And so I wouldn't be able to identify you individually
asking those questions.
So when you're building out surveys
and when you're building out systems
to have a de-identification in place,
you need to think these things through
because sometimes something that seems like it would work
because it works at a large company
won't work at a small company or vice versa.