Differences between anonymized aggregate data, de-identified data and anonymous data

Using data is essential for companies, institutions and public entities, whether it be for decision-making or to carry out scientific, economic or social studies.

However, to make use of data (store it, share it, analyze it, etc.), personal information must be protected to ensure the privacy of the data subjects.

Consequently, it is necessary for companies, organizations and other entities obliged to ensure compliance with privacy regulations to be able to recognize the differences between anonymized aggregate data, de-identified data and anonymous data.

Some types of data fall within the scope of data protection regulations, while others are not subject to these laws and standards. It is therefore necessary to clear some things up and debunk some myths about the type of data being processed.

What are aggregate data, de-identified data and anonymous data?

To understand the difference between anonymized aggregate data, de-identified data and anonymous data, one must understand what each individual term refers to. Although they may have many similar aspects, they are different kinds of data that should not be confused, especially when they contain personal information.

Anonymized aggregate data

Aggregate data is presented only in a set, as in a kind of summary. The data has been collected and combined to be displayed in groups with the aim of communicating some global information.

Normally, aggregate information is used to detect trends, make comparisons or observe behaviors that would be impossible to perceive in isolation.

For example, when a survey is conducted on the preferences between one political candidate or another, the aggregate information will be the set of values that show which candidate is the most popular.

In addition, certain filters can be applied to this data to obtain more detailed information, such as which candidate is the most popular in each region or the number of votes allocated to each politician according to the age of the voter. However, the aggregate data may reveal significant details about individuals and the data would not guarantee privacy.

For this reason, when the data contains personal information, before aggregation it must be subjected to an anonymization process that eliminates the values that can be used to identify or associate each individual. In this case, we are dealing with anonymized aggregate data.

But anonymized aggregate data should not be confused with de-identified data. The key is knowing that anonymization is a process that makes it impossible to re-identify the data subject, so it is no longer considered personal data and will not be subject to the requirements of the GDPR.

Related content:

Why All Companies Should Use Data Anonymization

De-identified data

De-identified data is data that has had personal information removed in order to protect the privacy of individuals but ensuring the usefulness of the data.

The data that is deleted serves as a unique identifier, for example, name, email, address or date of birth.

However, there may be risks of identification, because de-identification only manages to eliminate obvious or direct identifiers (names, age, etc.), and the indirect ones remain.

In addition, there is no worldwide consensus on what data is actually a personal identifier. For example, are IP addresses personal data?

The main difference between de-identified data and anonymized data is that the former may contain additional information that allows the individual to be associated or re-identified.

Anonymous data

In the case of anonymous data, identifying or associating the data subjects is impossible. This is data that has never contained personal information; therefore, it is not subject to privacy protection regulations.

It is ideal, because it can be processed, stored, analyzed and shared without carrying out any protection procedures.

Why is data protection important and when should each of these techniques be used?

The European Union's General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA) or the Consumer Privacy Protection Act (CPPA) are specific legal texts that require companies and organizations to implement techniques or procedures for the protection of personal data.

However, ensuring data protection goes beyond compliance with legal regulations.

First and foremost, protecting personal data is a way to protect citizen's fundamental right to privacy.

Secondly, protecting data means avoiding fines and improving the image of the organization or company.

In this context, it is important to know when to apply aggregation, de-identification and anonymization techniques. Although they may present the risk of not completely guaranteeing privacy, they do offer a certain degree of protection.

• If you wish to be exempt from the application of the GDPR, anonymized data must be used. Of course, you must be sure that it is anonymized information and that there is no risk of direct or indirect association with the data holder, nor risk of re-identification of the individual.

Otherwise, it is not called anonymized data, but rather pseudonymized data.             With the latter technique, two groups of information are generated: the pseudonymized information and another group of values that allows the anonymization process to be reversed.

• Aggregation is not sufficient to ensure data protection. If the aggregated information must be visualized for analysis purposes, it is essential to use anonymized grouped data.

Recommended reading:

Best data anonymization tools and techniques

Tools that help with data masking

Data anonymization or pseudonymization is one of the masking techniques that is very frequently used to protect personal information in accordance with the precepts of European regulations.

Masking tools must be able to automatically detect direct and indirect personal data and apply various preconfigured masking techniques.

In addition, they must have strict encryption algorithms that prevent reverse engineering and comply with international regulations. This is the only way to reduce risk and minimize liability when handling or processing data.

Explore our Masker tool to guarantee data privacy.

Related content:

How to avoid data privacy issues in Europe

Discover Masker, Pangeanic's data anonymization solution

At Pangeanic, we have developed Masker, our data masking software whose algorithm is driven by Artificial Intelligence and complies with worldwide privacy standards. This way, you can protect your company with effective and completely secure anonymization.

Masker can automatically detect personal data, whether it is categorized as direct or indirect.

In addition, the type of masking, the level of aggressiveness and, if desired, the reversibility of the anonymization can be preset for a completely customized process.

Contact us if you want to reduce the risks of storing and sharing personal or sensitive information.