Anonymisaton, Pseudonymisation, and De-identification Primer

Data anonymisation, pseudonymisation, and de-identification all have a long-standing history in data governance, statistics, and privacy/data protection. Sometimes they are treated individually, sometimes together. In recent years they gained further interest as a form of Privacy Enhancing Technology (PET), and more recently as a key component in ‘privacy-oriented’ Artificial Intelligence / Machine Learning (AI / ML). These techniques are theoretically powerful privacy mechanisms but still carry various types of re-identification risks and privacy failures when applied without correct understanding.

This course provides a thorough overview and comparison of all three techniques, how they operate and what considerations need to be taken into account when applying them in different scenarios. The course highlights conceptual and practical nuances within the privacy / data protection domain, demonstrates the techniques and limitations, and provides a solid foundation for privacy-minded AI / ML (which also serves as a stepping stone to various discussions about AI / ML / model explainability).

This course is ideal for busy DPOs, AI / ML professionals, project managers, and compliance officers, who are responsible for data sharing and data protection, be it through policy approaches, risk management, governance, or actual implementation. The course explains the typical engineering jargon and technical details in an understandable manner for non-Information Technology (IT) audience.

This course complements our Anonymising Data using k-Anonymity and Pseudonymisation Primer courses.

Who should attend?

• Data Protection Officers (DPOs), AI / ML Professionals, Compliance Professionals, and Corporate / In-house Counsels
• Privacy / Software Engineers, Technical Staff, Developers, Data Analysts, Data Architects, and Project / Risk Managers

Course Details

Course Outline

• Core aspects and intended scope
  • Identity, Identification, Identifiability, and sensitivity of data
  • Data attribute types and Data utility
  • Data secrecy versus identity secrecy versus protection and obfuscation
  • Definitions

• Typical Techniques  
  • Simple appending / replacement / distortion
  • Advanced techniques
  • Use case dependence

• Critical differences / overlaps
  • Threat models and risk levels
  • Tool support

• Overview on Guidance 
  • Personal Data Protection Commission (PDPC), Association of Southeast Asian Nations (ASEAN), and Asia Pacific Privacy Authorities (APPA) (“5-step approach”)
  • General Data Protection Regulation (GDPR)
  • European Data Protection Board (EDPB)

Course Facilitator

Albert Pichlmaier   Senior Cybersecurity and Privacy Engineer Senior Learning Technology Designer, Drew Data Protection & Cybersecurity Academy