Quasi-Identifier

The quasi-identifier is Latanya Sweeney’s technical formalization of a structural fact about data that the privacy industry spent decades pretending was not there. Identity does not reside in a single datum that can be deleted—a name, a social security number, an address—but is distributed across combinations of attributes, each individually harmless and routinely retained in “anonymized” datasets, that together constitute a unique fingerprint. Sweeney’s foundational proof: using United States census data, she estimated that roughly 87 percent of the American population could be uniquely identified by just three fields available in virtually every health dataset released as “de-identified”—five-digit ZIP code, date of birth, and sex. None of these is secret. All three are collected as a matter of routine. Their combination is, for most people, unique. A dataset stripped of names but retaining these fields is not anonymous; it is pseudonymous at best, and pseudonymity is a thin protection against any adversary willing to perform the join against a second dataset