People and data: consent, privacy and the limits of anonymisation

A plan that says it will anonymise the data has made a promise it may not be able to keep. Deleting names, and even a list of obvious identifiers, does not make a dataset anonymous. Anonymity is a relation between a dataset, a population, an adversary and other data about that population, not a property a file acquires.

This eighth of ten units argues that consent, data protection law, retention and the estimate of re-identification risk leave the annexe and become method. A claim of anonymisation without a stated adversary, a release model and a basis for the risk estimate is not a claim at all.

Anonymity is a relation, not a property of a file

Sweeney (2002) proposed k-anonymity, under which each person's information in a release cannot be distinguished from at least k-1 others whose information also appears in it. The guarantee holds for the attributes she calls quasi-identifiers, and attacks succeed against releases meeting the model unless the accompanying deployment policies are applied.

How can a data holder release a version of its private data with scientific guarantees that the individuals who are the subjects of the data cannot be re-identified while the data remain practically useful?

Narayanan and Shmatikov (2008) attacked the Netflix Prize dataset, which held the anonymous ratings of 500,000 subscribers, using the Internet Movie Database as background knowledge. An adversary who knew only a little about a subscriber could identify that subscriber's record. The attack needed no names, only a second dataset about the same people. The attack is robust to perturbation and tolerates some mistakes in the adversary's background knowledge, so adding noise is weaker protection than it is often taken to be.

Rocher, Hendrickx and de Montjoye (2019) estimated the risk when the data are incomplete, using a generative copula model on 210 populations. They found that 99.98 per cent of Americans would be correctly re-identified in any dataset using 15 demographic attributes. They concluded that heavily sampled datasets are unlikely to meet standards set out in the General Data Protection Regulation.

Ohm (2010) drew the legal conclusion: the assumption that removing identifiers makes data safe pervades nearly every privacy law and is a fundamental misunderstanding.

Rodriguez and colleagues (2024) surveyed United Kingdom researchers on de-identification and risk estimation for clinical trial datasets, collecting 38 responses in 2022: 35 (92 per cent) used documented processes, while 11 (29 per cent) knew of risk estimation and did not use any methodology.

Consent cannot carry the weight alone

If anonymity cannot be guaranteed, consent is the next candidate, and the behavioural literature explains why it cannot carry the weight alone. Acquisti, Brandimarte and Loewenstein (2015) review empirical research on privacy behaviour through three themes: uncertainty about consequences and preferences, the context-dependence of privacy concern, and the malleability of those concerns. Stated preference is a poor guide to what a participant will later accept, and Beresford, Kubler and Preibusch (2012) show a euro of discount outweighing it. A notice written in legal language moves that burden, most of all for a reader in a second language.

Nissenbaum (2004) offers the alternative. Contextual integrity ties protection to the norms of the context in which information was generated, requiring that gathering and dissemination be appropriate to that context and obey its norms of distribution. Applied to research data, the test is whether a new use respects the setting it came from.

Fiesler and Proferes (2018) found few Twitter users aware that their public tweets could be used, and most felt researchers should not use them without consent. Luger and Sellen (2016) interviewed 14 users of conversational agents and found expectations out of step with the systems' operation. Users therefore revealed information while holding unsupported models: consent that depends on a participant predicting what a system records and reveals is consent to a system they do not understand. The design response is to collect less.

The law turns a risk estimate into a procedure

Voigt and von dem Bussche (2017) analyse the provisions of the General Data Protection Regulation systematically, though the guide predates the United Kingdom's divergence from it. They cover its scope, the organisational and material requirements, the rights of data subjects and the role of supervisory authorities. The Information Commissioner's Office (2023) sets out when a data protection impact assessment is required and how to conduct it, with steps that include describing the processing, assessing necessity and proportionality, assessing risks and mitigations, and consulting the regulator where high risk remains. The procedure already requires what the anonymisation claim depends on, a description of what is held and a documented assessment of the risk to the people in it.

The regime those documents describe has since changed. The Data (Use and Access) Act 2025 amends the United Kingdom General Data Protection Regulation and the Data Protection Act 2018: it defines processing for scientific research, permits consent to an area of research where the exact purpose cannot be fixed at the outset, and consolidates the safeguards for research, archiving and statistical purposes (Data (Use and Access) Act 2025). A proposal that reasons from the 2017 guide alone describes a regime that no longer governs it.

Stalla-Bourdillon (2025) examines recent European Union developments. These include Court of Justice case law, national authority assessments, and the European Data Protection Board's Opinion 28/2024 and Guidelines 01/2025. She suggests a functional definition of personal data is emerging and underscores the burden of proof. The duty is to demonstrate that re-identification is not reasonably likely.

Privacy has to be designed in, retention included

Cavoukian (2009) sets out seven foundational principles of privacy by design. Two bear on the argument: privacy as the default removes the burden of a correct choice from the participant, and end-to-end lifecycle protection places retention inside the design.

Langheinrich (2001) made the HCI case earlier. He developed six principles for privacy-aware ubiquitous systems from the fair information practices common in privacy legislation, from notice and consent to anonymity, security and recourse. He argues such systems need privacy built in, because users cannot manage it after the fact.

Contested question: does anonymisation still do any work?

One position holds that anonymisation as a legal and practical promise has failed. Ohm (2010) is its clearest statement, and Narayanan and Shmatikov (2008) and Rocher and colleagues (2019) supply the force. A rich released dataset was re-identified with modest background knowledge, and on Rocher's estimate the attributes needed are few and sampling does not remove the risk.

The opposing position holds that a defensible standard exists and is being tightened. Sweeney (2002) gives a formal guarantee with stated conditions rather than a general assurance. Stalla-Bourdillon (2025) argues that a functional definition of personal data is emerging, with the burden of proof on the controller, a workable test rather than an impossible one. Rodriguez and colleagues (2024) cut both ways. Some 92 per cent used documented processes, but only 29 per cent knew of risk estimation and none used a methodology.

A second dispute asks whether consent does any work once anonymity is conceded. Acquisti, Brandimarte and Loewenstein (2015) find privacy decisions uncertain, context-dependent and malleable, which makes stated consent a weak predictor. Nissenbaum (2004) relocates the wrong to the inappropriateness of the flow. Fiesler and Proferes (2018) find users want consent in specifics. The three are compatible only if consent is one input to a contextual judgement rather than the judgement itself.

What would settle the first dispute is a standardised risk estimate applied to a defined class of releases, with the auxiliary data named, and the estimate validated against attempts to re-identify that class. What would settle the second is a field comparison of a consent-only process with a context-sensitive one, measuring what participants accept and later report. No source here performs either test, which is why the disagreement is live.

Read by kind, the dispute is asymmetric. The negative side carries the only demonstrations, an executed attack on a released dataset and a computed risk estimate across 210 populations, while the positive side rests on a formal model with stated conditions and on a reading of emerging law. The survey of 38 researchers is too small to decide between them. While the dispute is open, a student should state the adversary and the auxiliary data assumed, name the release model, and report the risk estimate as a figure beside the retention period. The strongest objection is Ohm's: since his remedy is to regulate use rather than release, a proposal may answer the underlying worry through the conditions it places on access, without the estimate the unit demands.

Where the argument is heading

The direction is from assertions of anonymity to demonstrations of acceptable risk. Stalla-Bourdillon (2025) documents the machinery being built for it. That includes the need to reconcile the Regulation with newer data-sharing mandates. Rocher and colleagues (2019) show the risk estimate becoming computable rather than rhetorical. A generative model can price the likelihood of re-identification in an incomplete dataset. The proposal that survives reports the risk assessment as a result, beside the retention period and the release model.

The sources this unit rests on

Each note states what the work did, what it found and how it bears on the argument. Every identifier was resolved on 2 November 2026.

• Acquisti, A., Brandimarte, L. and Loewenstein, G. (2015). Privacy and human behaviour in the age of information (the published title uses the American spelling). doi:10.1126/science.aaa1465 Review of empirical research on privacy behaviour under three themes: uncertainty about consequences and preferences, the context-dependence of concern, and malleability. It finds stated preference a poor guide to behaviour.
• Beresford, A., Kubler, D. and Preibusch, S. (2012). Unwillingness to pay for privacy: a field experiment. doi:10.1016/j.econlet.2012.04.077 Field experiment in which buyers chose between two identical online DVD stores, one demanding more personal data; almost all chose that store when it was one euro cheaper. It carries the unit's claim that preference does not govern disclosure behaviour.
• Cavoukian, A. (2009). Privacy by design: the 7 foundational principles. https://www.ipc.on.ca/en/media/1467/download?attachment Report setting out seven principles of privacy by design, from privacy as the default to end-to-end lifecycle protection.
• Fiesler, C. and Proferes, N. (2018). "Participant" Perceptions of Twitter Research Ethics. doi:10.1177/2056305118763366 Exploratory survey of Twitter users finding few were aware their public tweets could be used and that the majority wanted consent sought. It carries the unit's claim that the acceptable standard is more specific than the regulatory one.
• Information Commissioner's Office (2023). Data protection impact assessments. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/ The UK regulator's guidance on when a data protection impact assessment is required and its steps, from describing the processing to assessing necessity, proportionality and risk. It carries the unit's claim that the law makes the risk assessment a method duty.
• Langheinrich, M. (2001). Privacy by Design: Principles of Privacy-Aware Ubiquitous Systems. doi:10.1007/3-540-45427-6_23 Conference paper developing six privacy principles for ubiquitous systems from the fair information practices in legislation, from notice and consent to anonymity, security and recourse. It argues systems must build privacy in, since users cannot manage it afterwards, which is the unit's design-in claim.
• Luger, E. and Sellen, A. (2016). "Like Having a Really Bad PA". doi:10.1145/2858036.2858288 Interviews with 14 users of conversational agents finding expectations out of step with the systems' operation, so users revealed information while holding unsupported models. It carries the unit's claim that consent fails when the participant cannot predict what the system records.
• Narayanan, A. and Shmatikov, V. (2008). Robust De-anonymization of Large Sparse Datasets (the published title uses the American spelling). doi:10.1109/sp.2008.33 De-anonymisation attack on the Netflix Prize dataset of 500,000 ratings, using the Internet Movie Database as background knowledge, which is enough to identify subscribers' records.
• Nissenbaum, H. (2004). Privacy as contextual integrity. https://digitalcommons.law.uw.edu/wlr/vol79/iss1/10/ Article setting out contextual integrity, in which the wrong is the inappropriate flow of information given the norms of the context that generated it, reaching cases consent leaves unresolved.
• Ohm, P. (2010). Broken promises of privacy: responding to the surprising failure of anonymization (the published title uses the American spelling). https://www.uclalawreview.org/broken-promises-of-privacy-responding-to-the-surprising-failure-of-anonymization-2/ Law review article arguing that the assumption that removing identifiers makes data safe pervades privacy law as a misunderstanding, proposing a shift from release to regulating use. It carries the unit's account of that evidence's legal consequence.
• Rocher, L., Hendrickx, J. M. and de Montjoye, Y.-A. (2019). Estimating the success of re-identifications in incomplete datasets using generative models. doi:10.1038/s41467-019-10933-3 Generative copula method for estimating the likelihood a person is re-identified in a heavily incomplete dataset, evaluated on 210 populations. It estimated that 99.98 per cent of Americans would be re-identified from 15 demographic attributes, so sampling does not remove the risk.
• Rodriguez, A., Lewis, S. C., Eldridge, S., Jackson, T. and Weir, C. J. (2024). A survey of UK researchers' de-identification and re-identification risk practice for clinical trial datasets (the published title is longer). doi:10.1177/17407745241259086 It collected 38 responses in 2022: 35 (92 per cent) used documented processes, while 11 (29 per cent) knew of risk estimation and none used a methodology, so quantified risk estimation is the missing step.
• Stalla-Bourdillon, S. (2025). Identifiability, as a Data Risk: Is a Uniform Approach to Anonymisation About to Emerge in the EU? doi:10.1017/err.2025.16 Article on recent European Union developments in identifiability and anonymisation, including Court of Justice case law, authority assessments and Data Protection Board guidance on pseudonymisation. It suggests a functional definition of personal data is emerging and stresses the burden of proof.
• Sweeney, L. (2002). k-anonymity: a model for protecting privacy. doi:10.1142/s0218488502001648 Paper proposing k-anonymity, under which each record is indistinguishable from at least k-1 others on the quasi-identifiers. It states the conditions for the guarantee and examines attacks that succeed unless deployment policies are applied, so the assurance is conditional.
• Voigt, P. and von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. doi:10.1007/978-3-319-57959-7 Practitioner guide analysing the General Data Protection Regulation, covering its scope, the organisational requirements, the rights of data subjects and the role of supervisory authorities.
• Data (Use and Access) Act 2025. c. 18. https://www.legislation.gov.uk/ukpga/2025/18 Amends the United Kingdom General Data Protection Regulation and the Data Protection Act 2018 for research processing, defining scientific research and allowing consent to an area of research where the exact purpose is not yet known. Its safeguards require data minimisation through pseudonymisation and bar processing likely to cause substantial damage or distress.