Separating the baby from the bathwater: Toward a generic and practical framework for anonymization

Anonymization - the process of removing or otherwise transforming information so as to reduce the ability to associate it with an identifiable individual - has been much criticized of late, yet interest in it remains high in many quarters. Potential use cases, including those found in the homeland security domain, vary much more widely than those represented by the incidents that have cast doubt on anonymization's utility. Dealing with this variety effectively and efficiently, though, poses challenges. This paper will present a generic anonymization methodology for tabular textual data being developed by the Science and Technology Directorate of the Department of Homeland Security. This methodology views anonymization as a single, non-exclusive privacy risk control to be considered along with other potential controls. The anonymization process it describes is as much a programmatic risk management process as a technical one. It aims to make anonymization more of a systems engineering activity.