De-identified, Anonymized, or Aggregated? A Look around the Globe

This talk examines the complex landscape of privacy and data protection regulations concerning anonymous or de-identified data. While such data is often considered outside the scope of privacy regulations, the need for common definitions and clear guidelines for the appropriate risk assessment remain a challenge in practice. The talk provides a comparative analysis of data protection regulations, highlighting crucial questions that require resolution. One particular concern is the exclusion of aggregated consumer information from new U.S. state privacy laws, despite its susceptibility to reidentification. The key message emphasizes the shared uncertainty surrounding the circumstances under which data can be deemed anonymous or deidentified, as well as the necessity for a common understanding of the state of the art of effective privacy technologies and methodologies in the field. The speaker hopes to encourage regulators to familiarize themselves with advanced anonymization techniques, such as differential privacy, and provide clear and consistent guidance to practitioners. Given the significance of these questions, it is imperative to address them with legal clarity and ensure adequate privacy safeguards.