+SI-19 De-identification
---+SI-19(01) Collection
---+SI-19(02) Archiving
---+SI-19(03) Release
---+SI-19(04) Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
---+SI-19(05) Statistical Disclosure Control
---+SI-19(06) Differential Privacy
---+SI-19(07) Validated Algorithms and Software
---+SI-19(08) Motivated Intruder
|
SI-19 De-identification
Control
- Remove the following elements of personally identifiable information from datasets: [Assignement: elements] ; and
- Evaluate [Assignement: frequency] for effectiveness of de-identification.
Discussion
De-identification is the general term for the process of removing the association between a set of identifying data and the data subject. Many datasets contain information about individuals that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother’s maiden name, or biometric records. Datasets may also contain other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. Personally identifiable information is removed from datasets by trained individuals when such information is not (or no longer) necessary to satisfy the requirements envisioned for the data. For example, if the dataset is only used to produce aggregate statistics, the identifiers that are not needed for producing those statistics are removed. Removing identifiers improves privacy protection since information that is removed cannot be inadvertently disclosed or improperly used. Organizations may be subject to specific de-identification definitions or methods under applicable laws, regulations, or policies. Re-identification is a residual risk with de-identified data. Re-identification attacks can vary, including combining new datasets or other improvements in data analytics. Maintaining awareness of potential attacks and evaluating for the effectiveness of the de-identification over time support the management of this residual risk.
Assessment Objective
- [Assignement: elements] are removed from datasets;
- the effectiveness of de-identification is evaluated [Assignement: frequency].
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
de-identification procedures
system configuration
datasets with personally identifiable information removed
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel responsible for identifying unnecessary identifiers
organizational personnel responsible for removing personally identifiable information from datasets
organizational personnel with information security and privacy responsibilities
1. Ülevaade
| Pealkiri |
Standard |
|
SI-19(01) Collection
|
Control
De-identify the dataset upon collection by not collecting personally identifiable information.
Discussion
If a data source contains personally identifiable information but the information will not be used, the dataset can be de-identified when it is created by not collecting the data elements that contain the personally identifiable information. For example, if an organization does not intend to use the social security number of an applicant, then application forms do not ask for a social security number.
Assessment Objective
the dataset is de-identified upon collection by not collecting personally identifiable information.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
de-identification procedures
procedures for minimizing the collection of personally identifiable information
system configuration
data collection mechanisms
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel responsible for de-identifying the dataset
organizational personnel with information security and privacy responsibilities
|
|
SI-19(02) Archiving
|
Control
Prohibit archiving of personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.
Discussion
Datasets can be archived for many reasons. The envisioned purposes for the archived dataset are specified, and if personally identifiable information elements are not required, the elements are not archived. For example, social security numbers may have been collected for record linkage, but the archived dataset may include the required elements from the linked records. In this case, it is not necessary to archive the social security numbers.
Assessment Objective
the archiving of personally identifiable information elements is prohibited if those elements in a dataset will not be needed after the dataset is archived.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
de-identification procedures
system configuration documentation
data archiving mechanisms
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel responsible for de-identifying the dataset
organizational personnel with dataset archival responsibilities
organizational personnel with information security and privacy responsibilities
|
|
SI-19(03) Release
|
Control
Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.
Discussion
Prior to releasing a dataset, a data custodian considers the intended uses of the dataset and determines if it is necessary to release personally identifiable information. If the personally identifiable information is not necessary, the information can be removed using de-identification techniques.
Assessment Objective
personally identifiable information elements are removed from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
de-identification procedures
procedures for minimizing the release of personally identifiable information
system configuration
data release mechanisms
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel responsible for de-identifying the dataset
organizational personnel with information security and privacy responsibilities
|
|
SI-19(04) Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
|
Control
Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.
Discussion
There are many possible processes for removing direct identifiers from a dataset. Columns in a dataset that contain a direct identifier can be removed. In masking, the direct identifier is transformed into a repeating character, such as XXXXXX or 999999. Identifiers can be encrypted or hashed so that the linked records remain linked. In the case of encryption or hashing, algorithms are employed that require the use of a key, including the Advanced Encryption Standard or a Hash-based Message Authentication Code. Implementations may use the same key for all identifiers or use a different key for each identifier. Using a different key for each identifier provides a higher degree of security and privacy. Identifiers can alternatively be replaced with a keyword, including transforming "George Washington" to "PATIENT" or replacing it with a surrogate value, such as transforming "George Washington" to "Abraham Polk."
Assessment Objective
direct identifiers in a dataset are removed, masked, encrypted, hashed, or replaced.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
de-identification procedures
system configuration
documentation of de-identified datasets
tools for the removal, masking, encryption, hashing or replacement of direct identifiers
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel responsible for de-identifying the dataset
organizational personnel with information security and privacy responsibilities
|
|
SI-19(05) Statistical Disclosure Control
|
Control
Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.
Discussion
Many types of statistical analyses can result in the disclosure of information about individuals even if only summary information is provided. For example, if a school that publishes a monthly table with the number of minority students enrolled, reports that it has 10-19 such students in January, and subsequently reports that it has 20-29 such students in March, then it can be inferred that the student who enrolled in February was a minority.
Assessment Objective
- numerical data is manipulated so that no individual or organization is identifiable in the results of the analysis;
- contingency tables are manipulated so that no individual or organization is identifiable in the results of the analysis;
- statistical findings are manipulated so that no individual or organization is identifiable in the results of the analysis.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
de-identification procedures
system configuration
de-identified datasets
statistical analysis report
tools for the control of statistical disclosure
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel responsible for de-identifying the dataset
organizational personnel with information security and privacy responsibilities
|
|
SI-19(06) Differential Privacy
|
Control
Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.
Discussion
The mathematical definition for differential privacy holds that the result of a dataset analysis should be approximately the same before and after the addition or removal of a single data record (which is assumed to be the data from a single individual). In its most basic form, differential privacy applies only to online query systems. However, it can also be used to produce machine-learning statistical classifiers and synthetic data. Differential privacy comes at the cost of decreased accuracy of results, forcing organizations to quantify the trade-off between privacy protection and the overall accuracy, usefulness, and utility of the de-identified dataset. Non-deterministic noise can include adding small, random values to the results of mathematical operations in dataset analysis.
Assessment Objective
the disclosure of personally identifiable information is prevented by adding non-deterministic noise to the results of mathematical operations before the results are reported.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
de-identification procedures
system configuration
de-identified datasets
differential privacy tools
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel responsible for de-identifying the dataset
organizational personnel with information security and privacy responsibilities
|
|
SI-19(07) Validated Algorithms and Software
|
Control
Perform de-identification using validated algorithms and software that is validated to implement the algorithms.
Discussion
Algorithms that appear to remove personally identifiable information from a dataset may in fact leave information that is personally identifiable or data that is re-identifiable. Software that is claimed to implement a validated algorithm may contain bugs or implement a different algorithm. Software may de-identify one type of data, such as integers, but not de-identify another type of data, such as floating point numbers. For these reasons, de-identification is performed using algorithms and software that are validated.
Assessment Objective
- de-identification is performed using validated algorithms;
- de-identification is performed using software that is validated to implement the algorithms.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
de-identification procedures
system configuration
de-identified datasets
algorithm and software validation tools
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel responsible for de-identifying the dataset
organizational personnel with information security and privacy responsibilities
|
|
SI-19(08) Motivated Intruder
|
Control
Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.
Discussion
A motivated intruder test is a test in which an individual or group takes a data release and specified resources and attempts to re-identify one or more individuals in the de-identified dataset. Such tests specify the amount of inside knowledge, computational resources, financial resources, data, and skills that intruders possess to conduct the tests. A motivated intruder test can determine if the de-identification is insufficient. It can also be a useful diagnostic tool to assess if de-identification is likely to be sufficient. However, the test alone cannot prove that de-identification is sufficient.
Assessment Objective
a motivated intruder test is performed on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
de-identification procedures
system configuration
motivated intruder test procedures
de-identified datasets
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Interview
Organizational personnel responsible for de-identifying the dataset
organizational personnel with information security and privacy responsibilities
|
1.1 Viited
1.2 Tuvastatud nõuded
1.3 Seotud regulatsioonid
2. Tuvastatud nõuded
3. Seotud regulatsioonid
Regulatsioonid
| Allikas |
Regulatsioon |
Lingitud teemad
|