Anonymised data sets not as secure as thought

Individual people can be sometimes published with little effort from large, anonymous records.

The researchers found the US Massachusetts Institute of Technology (MIT) and the Danish University of Aarhus reveal research result. They examined a set of credit card data of 1.1 million people. The data contained neither names nor bank account numbers, but only the date, place and amount of payments that had been made by a particular account.

Nevertheless, the researchers were able to find an individual with a high probability in the record. For this purpose they had to know only four payment transactions with them and reconcile with the data set. Such private information can be derived for example, from a public tweet or a vote on the Internet.

The researchers did in this way that a person on Monday buy a coffee with a credit card paid, had bought on Tuesday at the grocery store, was in a sporting goods store and on Friday on Thursday at a clothing store, they could that person in 90 percent of cases in the find record.


For the researchers, the results show that even large data sets often do not provide complete anonymity. This applies not only for credit card information. Even surfing the Internet, the use of public transport or when streaming movies over online services fall en masse on data collected and analyzed. It is likely that these data could be easily again, despite anonymization individuals assigned, the researchers write in the scientific journal Science.

Just because a record does not contain any names, addresses, telephone numbers or other obvious characteristics (..) makes him not anonymous. This requires a new discussion on privacy, because personal information is protected, anonymous records but not. Our results show that a reform of our data protection is needed that goes beyond personal information leak out.