“Anonymized” data may not be so anonymous after all

One definition of a human subject, per the Revised Common Rule, is a living individual about whom an investigator obtains, uses, studies, analyzes, or generates identifiable private information (emphasis added). Generally, data recorded without identifiers is not considered to be human subject data, because the identity of the subject cannot be “readily ascertained by the investigator or associated with the information.”

At least for now. The New York Times reports “computer scientists have developed an algorithm that can pick out almost any American in databases supposedly stripped of personal information.” Not only that, but they “posted their software code online for anyone to use.”

The scientists say the reidentification is possible if the dataset contains about 15 attributes.

What does this mean for research? Nothing, at least not this week. But does this mean we will need to rethink our notion of what constitutes identifiable data? What do you think?