By Guillaume Vrijens, Data Scientist at Euranova

To operate ethically and securely in today's data-driven economy, companies must navigate a complex web of binding regulations. Frameworks such as the GDPR (2016), the e-Privacy Directive (2002), and recent additions like the Data Act (2022), Data Governance Act (2022), and the AI Act (2024) have fundamentally shifted how organizations must handle information.

The business impact of non-compliance is severe. Under the AI Act, organizations face massive financial penalties, up to €30 million or 6% of their annual turnover. Beyond regulatory fines, strict adherence to privacy standards is a critical requirement for maintaining brand reputation and preserving long-term customer trust.

The trigger for these legal frameworks is "personal data": it can include any information collected from a person, such as employee timesheets and customer feedback, but also indirect information like a phone's battery life cycle. Defining this scope accurately is what establishes the boundaries of protection. However, many organizations falsely believe their data is safe simply because obvious identifiers are hidden. A classic empirical example is the 2007 Netflix Prize incident, where researchers successfully re-identified users within a supposedly anonymous dataset by cross-referencing movie ratings with public IMDB reviews. This underscored a vital lesson: stripping a name is rarely enough to protect an identity.

The Core Challenge of Re-identification

Recently, a leading automotive manufacturer approached Euranova to address this exact challenge. Their objective was to create a personal data anonymization process to facilitate new use cases with their data, driving more business value, while maintaining secure and compliant usage.

To do this, we must shatter the illusion of anonymity. Research demonstrates that 87% of individuals in the U.S. can be uniquely identified using a combination of just three attributes: ZIP code, birth date, and sex. Even seemingly non-personal, routine data points can be combined to unmask individuals.

The core objective of anonymization is to mitigate this re-identification risk while protecting sensitive information. This creates a delicate balancing act. On one hand, we must enforce privacy protection by deleting direct identifiers and modifying indirect ones. On the other, we must maintain data utility, preserving the internal value and patterns of the data so it remains useful for analysis and research.

Why It Matters: The "Guess Who" Analogy

To understand how data privacy works in practice, think of the classic board game Guess Who?. The game board is essentially a database of people. To identify the opponent's secret character, you don't need to know their name: you just need a few specific attributes. By combining clues like "has a brown beard" and "wears glasses," you quickly eliminate everyone else until only one person remains.

In the real world, this same logic is used to unmask anonymous data. A company might delete your name and email from their records, thinking you are now anonymous. But someone else can simply play Guess Who? with the remaining information.

Instead of looking for a brown beard, they look for behavioral clues. They might pinpoint "the person who drives an electric car and always arrives at the downtown parking garage at 6:00 AM." Or, they might look at supermarket data to find "the shopper who only visits the store late at night and consistently buys cookies and cheese."

Even without names attached, these unique combinations of daily habits usually point to exactly one person.

This is the core challenge of data anonymization: organizations must find a way to blur those unique details just enough so the individual blends back into the crowd, without destroying the data's usefulness for the business.

The Blueprint: How Do We Do It?

Achieving this balance while adhering to legal guidelines requires a structured, multi-step process.

1. Clarifying the Terminology

The term "anonymization" is often used loosely to describe entirely different concepts. Let’s first define exactly what is happening to the data:

• Pseudonymisation: This involves removing or replacing direct identifiers with pseudonyms. It is an effective security measure, but the data remains subject to GDPR.
• De-identification: This modifies information to ensure the re-identification risk is acceptably small. While this places the data outside of GDPR, it heavily relies on hypotheses and requires strict governance.
• Synthetic Data: This generates entirely new data based on the original distribution. It falls outside of GDPR (provided sufficient privacy guarantees exist) and eliminates the need for hypotheses, though it is computationally expensive.

2. Managing Re-identification Risk

Legal entities, such as the EU Article 29 Working Party, define re-identification risk through three core concepts:

• Singling-out: The possibility of isolating records that identify an individual.
• Linkability: The ability to connect records concerning the same subject across databases.
• Inference: The ability to deduce an attribute's value with significant probability.

Organizations typically choose between two approaches. The Zero-risk approach attempts to strongly modify data to satisfy privacy models (like k-anonymity), though these models have known limits and proving technical zero risk is impossible. The Risk-based approach is the recommended, pragmatic path in the scientific community. It evaluates risk through metrics and threat models to ensure vulnerabilities remain "acceptably small" based on the business's context and value.

To quantify this, we advise a 4-step risk assessment:

1. Define the severity and impact of a potential private data leak.
2. Apply anonymization methods such as perturbation, generalization, suppression, or synthetic data generation.
3. Measure the privacy risk likelihood regarding singling out, linkability, and inference.
4. Calculate the final risk rating using a risk matrix to establish acceptable thresholds.

3. Building an Anonymisation Framework

To implement this approach, engineering and data teams apply a 5-step framework:

• Step 1: Input Data Definition: Identify the raw data sources and their formats. This dictates the strategy, whether dealing with Tabular data (rows and columns), Text (unstructured with sensitive phrases), Mobility data (spatio-temporal movement), or Image/Video (visual identifiable objects).
• Step 2: Output Data Design: Determine the desired final state. A Record-Level output maintains a one-to-one relationship with the original data but relies on risk hypotheses, while an Aggregated output uses queries or synthetic generation for stronger privacy guarantees.
• Step 3: Privacy Risk Measurement: Translate legal definitions into technical realities by building threat models and benchmarking metrics across varying scenarios to ensure they fit the specific use case.
• Step 4: Risk Approach Design: Formulate the specific risk-based strategy and define the risk appetite for data protection.
• Step 5: Implementation: Execute the technical privacy metrics alongside establishing rigid governance checks, finalizing legal documentation, and setting up ongoing review processes to defend against emerging threats.

Conclusion

Anonymization is not a turnkey guarantee that instantly makes data universally safe. It is a deliberate, mathematically grounded practice that requires careful evaluation of risk appetite. By understanding the profound difference between pseudonymisation and true anonymization, and by implementing a structured, risk-based methodology, businesses can confidently unlock the value of their data. Ultimately, successfully navigating this landscape requires cross-functional alignment—bringing legal, technical, and upper management teams together to define what constitutes an acceptable risk.