People identified through credit-card use alone

Analysis suggests that making data anonymous is not enough to protect consumers.

Boer Deng

Figuring out what data can be used to identify someone has long befuddled those tasked with keeping information private. Sometimes, the data sets they use to obscure underlying identities fail to do so. A computer-science graduate student at Carnegie Mellon University in Pittsburgh, Pennsylvania, once uncovered the medical history of then-Massachusetts governor William Weld from de-identified insurance records, for example1.

So it is not particularly shocking that Yves-Alexandre de Montjoye, a computer-security researcher at the Massachusetts Institute of Technology (MIT) in Cambridge, and his colleagues managed to identify one individual from a sea of ‘anonymized’ credit-card data.