Methods of anonymizing private information

The invention is based on new methods to provide marketers, retailers, and others with private and/or confidential consumer data that can provide a clear understanding of their actual customers as a group, or as specific subgroups, including information about their customers' geography, lifestyles, buying habits, demographics, etc., while protecting the privacy and identity of individual consumers.

DETAILED DESCRIPTION The new methods allow consumers' privacy to be protected while at the same time allowing businesses dealing with those consumers to discover and gain from a detailed knowledge of those consumers' demographics, lifestyles, geography, etc. General Methodology The methods rely on the fact that there are established, legally authorized repositories of both consumers' credit, debit, convenience, and ATM card numbers and the matching consumers' names and addresses for each. Examples of such repositories are the major credit reporting companies, such as Equifax®, Experian®, and Trans-Union®. However, other entities hold significant amounts of this data as well. Examples include companies that generate databases of consumers' purchases, credit cards, shipping information, etc.; utilities that do the same; banks of all types; major Internet Service Providers (ISPs) such as America Online® that retain credit card and address information for millions of consumers; and major grocery and other retail chains that maintain “loyalty” databases that also capture similar or identical consumer data. All of these entities face major legal and market obstacles to selling consumer ID's by way of reverse-identifying as described above. However, the methods described herein avoid the need for providing reverse-identifying information to marketers and retailers, while still providing them with useful consumer information stripped of any specific information that would identify individuals, i.e., the new methods provide anonymous detailed consumer information. In the new methods, an organization widely acceptable to consumers (“Trusted Entity”) acts as an intermediary between the credit-data entities, additional (name-and-address-based) data appending companies, and the marketers working on behalf of a given store or consumer-centric business. As shown in FIG. 1 , the new methods work as follows. Step 1—A marketer compiles one or more data files, e.g., in a set or list. The set contains one or more data files, each containing the transaction information for an individual consumers' Customer Identification Number, e.g., a credit, debit, convenience, or bank (e.g. automated teller machine (ATM)) card number, or telephone number, but no name or address information for the individual customer is part of these individual files. This set of files contains transaction information. For example in a restaurant, the transaction information includes the date and time the consumer dined at the restaurant, each item that was ordered, the price of the items, how many people were in the party, how the customer paid for the meal, the server or cashier's identity, and many other potentially useful facts about the event. These files can be stored in hard copy on paper, or in electronic form in a database in a computer or on a computer-readable medium, such as a magnetic tape or disk, or in an analog or digital memory. Many typical point-of-sale (POS) systems inherently store all of this data for some period of time. Newer systems collect this same data from many units in a chain and “warehouse” it in a corporate database. Step 2—The set of files is sent to a “Customer Identifier,” such as a major credit reporting company, e.g., Equifax® (1550 Peachtree Street, Atlanta, Ga. 30309) and TransUnion® (120 South Riverside, 19th Floor, Chicago, Ill. 60606), which holds significant consumer credit data. The set of files can be sent physically to the Customer Identifier, e.g., by mail or courier, or can be sent electronically, e.g., by email, or by other means on a secure intranet, or via the Internet, using appropriate encryption software. Step 3—The Customer Identifier “reverse-identifies” each Customer Identification Number associated with each file in the list, and appends identifying information, e.g., the consumer's actual name and address, to each file. This manipulation of the files can be done physically, or electronically, e.g., by computer using standard software. For example, “database” software such as Oracle® or SQL Server® or Informix® can be used for such “queries” of the Customer Identifier's database. Step 4—The Customer Identifier then removes the Customer Identification Number from each file, and transfers the file, e.g., physically or electronically, to a Trusted Entity for verification and further transfer. Such a Trusted Entity might be, for instance, a well-known consumer advocacy organization such as Common Cause®, or a similar organization focused on privacy in the marketplace. The Trusted Entity can also be Equifax®, Experian®, or Trans-Union®. Either the Customer Identifier and Trusted Entity can be the same company (entity), or they can be different. However, consumers might have more confidence in a Trusted Entity that is not also a Customer Identifier, because a non-Customer Identifier Trusted Entity provides an extra set of “impartial eyes” to confirm the removal of the Customer Identification Number and/or address or other identifying information from the data file. Step 5—Regardless of which organization is chosen, the Trusted Entity examines the set of files, e.g., electronically, to assure that no Customer Identification Numbers are included with any consumer's name and address information, and then transfers the set of files to one or more Data Vendors, such as R. L. Polk (1623 Washington Ave. &num; 213, Alton, Ill.); Acxiom, Inc. (301 Industrial Blvd., Conway, Ariz.), Claritas, Inc. (San Diego, Calif.), or Geographic Data Technology, Inc. (11 Lafayette St., Lebanon, N.H.). Again, the files can be transferred physically, e.g., by mail or courier, or can be sent electronically, e.g., by email, or by other means on a secure intranet, or via the Internet. These Data Vendors collect and store commercial demographic, geographic, vehicular, lifestyle, and/or other information. In this step 5, the Data Vendors each append the information they have to each data file. The Data Vendor can be the same entity, or a different entity, as the Trusted Entity and as the Consumer Identifier. The same comments made above about consumer confidence apply here as well. Step 6—Each commercial Data Vendor receives the data file from, appends information to the data file, and returns the updated data file to, the Trusted Entity. Each Data Vendor is adding private information about the particular consumer to each (consumer) record in the data file (but without getting the Customer Identification Number). The private information can be one or more of age, sex, marital status, parental status, income, education level, race, occupation, ethnicity, property ownership, ages of children, geographic information (such as census and market identifiers), lifestyle preferences (such as hobbies, pet ownership, media watching/listening habits, and magazine and other subscriptions), personal interests (such as travel and fine dining), items purchased, donation habits, and financial information (such as number and types of credit cards owned and investments made). The private information can include professional “cluster” data, such as the data generated by Claritas Inc. using its PRIZM® system. Using statistical techniques that employ U.S. census data and consumer data, Claritas Inc. has categorized every community in the U.S. to one of numerous PRIZM clusters. Each PRIZM cluster represents a unique neighborhood type with its own lifestyle and consumer behavior patterns. After the Data Vendor has appended the particular set of variables contracted for, the data file is returned to the Trusted Entity. Step 6 can be repeated with numerous different Data Vendors, either in parallel or in series, who each add different data to the data file. Step 7—The Trusted Entity examines each file received back from the various Data Vendors and verifies that there is still no credit, debit, convenience, ATM, or other Customer Identification Number attached to any consumer's record. When all of the various Data Vendors originally contracted have completed their appending, the Trusted Entity then further process the data file in one or two additional steps. Step 8—First, all customer-identifying information is removed. This includes name, address, telephone number or any other Customer Identification Number (in the event a number was not removed in the earlier steps) or means by which the customer can be identified. Step 9—In an optional second step, any potential geographic identifiers, such as latitude and longitude coordinates of the residence, are “cut” out to a separate file, and their record order is scrambled to insure complete privacy. In this way, no “educated guesses” can be made about the customers' identity. Alternatively, any potentially identifiable geographic parameters might be “randomized,” e.g., their values can be altered slightly or the values of a small percentage of the data in a large data set is made significantly incorrect to protect the customer's identity. The U.S. Census Bureau does a similar “randomizing” by taking a small percentage of records, typically less than 5%, and intentionally changing the information to be incorrect. Then the Census Bureau warns any parties who might use the data that such inaccuracies are inherent to the data set. A similar randomization can be used in the data files created in the new methods. Step 10—Finally, the Trusted Entity delivers the data file(s) back to the marketer, e.g., electronically. At this point, each data file contains a list of records with potentially exhaustive information about the consumers about whom the file was created, but no identities whatsoever, and no address or other identity-related information. A reasonable fee for handling and processing the file can be paid to the Trusted Entity to cover its costs. Of course, the Consumer Identifier and the Data Vendors are paid for their information, typically for each “batch” of list(s) that are run, and generally factoring in how many thousands of records were processed in each batch. The marketer may analyze the completed file with any number of analytical techniques. Many well-known software applications can be used in this type of analysis, from standard relational database management systems (RDBMSs) such as Oracle®, IBM's DB2®, and Microsoft's SQL Server®, to more specialized “business intelligence” applications such as Brio®, Business Objects®, Oracle Express®. To those skilled in the art, an extremely accurate and detailed portrait of the “clientele” may then be created, with rich and accurate demographic, geographic, vehicular, lifestyle, psychographic, economic, and/or any other detail. This portrait will also be of sufficient precision to accurately define a list of extremely similar consumers, for the purposes of continued direct marketing efforts. Implementation The new methods can be carried out using various means of communication. For example, the individual consumer files can be stored on a computer-readable medium or in a computer memory. The files can be transferred physically on diskettes or electronically, e.g., by email on a dedicated intranet or on the Internet. The files can be encrypted using standard encryption software from such companies as RSA Security (Bedford, Mass.) and Baltimore®. The files can be stored in various formats, e.g., spreadsheets or database. The files can be manipulated to add additional data and to remove identifying data by commercially available software such as the RDBMS applications named above. The invention can be implemented in hardware or software, or a combination of both. The invention can be implemented in computer programs using standard programming techniques following the method steps and figures disclosed herein. The programs should be designed to execute on programmable computers each including a processor, a data storage system (including memory and/or storage elements), at least one input device, and at least one output device, such as a CRT or printer. Program code is applied to input data to perform the functions described herein and generate output information. The output information is applied to one or more output devices such as a printer, or a CRT or other monitor. Each program used in the new methods is preferably implemented in a high level procedural or object oriented programming language to communicate with a computer system. However, the programs can be implemented in assembly or machine language, if desired. In any case, the language can be a compiled or interpreted language. Each such computer program is preferably stored on a storage medium or device (e.g., ROM or magnetic diskette) readable by a general or special purpose programmable computer, for configuring and operating the computer when the storage media or device is read by the computer to perform the procedures described herein. The system can also be considered to be implemented as a computer-readable storage medium, configured with a computer program, where the storage medium so configured causes a computer to operate in a specific and predefined manner to perform the functions described herein. Of increasing popularity is the Internet-based processing of such information. In this method, files are transmitted from one processing party to the next in “real time” in encrypted form, with each processing party privy to the decryption technique necessary to process the particular data, ending with the completely processed data being sent back to the marketer over the Internet in a similarly encrypted manner. In this method, the entire process can be performed in minutes. 
 EXAMPLE The following example illustrates how the method works for several consumers buying the same type of item in one store. In most embodiments, many consumer files are collected and manipulated together. Customers A, B, C, . . . N each buy a cordless telephone in Store X. The transactions are recorded by a point-of-sale (POS) computer. The POS computer generates a data file containing Customer A thru N's credit card numbers, the dates of the transactions, the names of the items (cordless telephone), and the price. Store X sends the data file to a Customer Identifier (Equifax®), by email. The Customer Identifier adds the customers' names and addresses (Customer A—12 Main Street, Lincoln, Mass.; Customer B—99 Shady Hill Rd., Newton, Mass.; etc.) to the data file and removes the credit card number from the file. Thereafter, it sends the data file to Common Cause® electronically, for file verification and further transfer. Common Cause examines the data file to assure that no credit card or other identifying number is included with any of the Customers' names or addresses, and then transfers the data file to a Data Vendor (R. L. Polk, Inc.). The Data Vendor uses the Customers' names and addresses to search its computer database, and then locates information specific to each Customer. The Data Vendor retrieves information that Customer A is male, married, has two children ages 8 and 12, has two cars, has a college degree in chemical engineering, and an annual income over $75,000. Customer B is female, unmarried, age 34, owns a new Honda Accord, has no college degree, and an annual income of $50,000. The same type of information is retrieved for each Customer C through N. The Data Vendor appends this information to the data file and returns the file electronically to Common Cause. Common Cause examines the data file and verifies that there is still no credit, debit, convenience, ATM, or other identification number attached to the file. Then, it strips any remaining customer-identifying information from the file, including names, addresses, and telephone numbers, and any other number or information by which the customers can be individually identified. Next, it also removes any potential geographic identifiers, such as town names and latitude and longitude coordinates of the residence, and moves this information to a separate file. After all of these data manipulations, Common Cause delivers the anonymized data file back to Store X by email. At this point, the file contains a significant amount of information about all of the Store X's customers who bought a cordless telephone, but without identifying any of those customers. 
 Other Embodiments It is to be understood that while the invention has been described in conjunction with the detailed description thereof, the foregoing description is intended to illustrate and not limit the scope of the invention, which is defined by the scope of the appended claims. Other aspects, advantages, and modifications are within the scope of the following claims.