<figure><img src="image_1.png" /></figure>

HAL
open science

# Practical and ready-to-use methodology to assess the re-identification risk in anonymized datasets

Louis Philippe Sondeck, Maryline Laurent

► To cite this version:

Louis Philippe Sondeck, Maryline Laurent. Practical and ready-to-use methodology to assess the re-identification risk in anonymized datasets. Scientific Reports, 2025, 15 (23223), pp.1-11. 10.1038/s41598-025-04907-3 . hal-05249960v1

HAL Id: hal-05249960

https://hal.science/hal-05249960v1

Submitted on 6 Oct 2025 (v1), last revised 11 Jan 2026 (v2)

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Practical and Ready-to-Use Methodology to
Assess the re-identification Risk in Anonymized
Datasets

Louis-Philippe Sondeck¹* and Maryline Laurent²†

¹*COACHMESEC Consulting (Clever Identity), 151 rue des Meuniers, Bagneux, 92220, France.

²Samovar, Télécom SudParis, Institut Polytechnique de Paris, 19 Place Marguerite Perey, Palaiseau, 91120, France.

*Corresponding author(s). E-mail(s): louis.sondeck@cleveridentity.fr;

Contributing authors: maryline.laurent@telecom-sudparis.eu;

†These authors contributed equally to this work.

Abstract

To prove that a dataset is sufficiently anonymized, many privacy policies suggest that a re-identification risk assessment be performed, but do not provide a precise methodology for doing so, leaving the industry alone with the problem. This paper proposes a practical and ready-to-use methodology for re-identification risk assessment, the originality of which is manifold: (1) it is the first to follow well-known risk analysis methods (e.g. EBIOS) that have been used in the cyber-security field for years, which consider not only the ability to perform an attack, but also the severity such an attack can have on an individual; (2) it is the first to qualify attributes and values of attributes with e.g. degree of exposure, as known real-world attacks mainly target certain types of attributes and not others; 3) it is the first to provide clear, comprehensible criteria and interpretable, explainable assessment results.

**Keywords:** Privacy Impact Assessment, re-identification risk assessment, Anonymized dataset, Privacy
# 1 Introduction

There are several policies in the healthcare industry that address the issue of anonymizing data for disclosure, including the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule [1], the EMA 0070 Policy [2], and the GDPR [3]. These guidelines generally refer to well-known anonymization techniques (e.g. k-anonymity, l-diversity, differential privacy,...). Many of them define a two-sided approach to anonymization, either by applying a well-defined method (e.g. Safe Harbor for HIPAA, WP29 anonymization criteria fulfillment for GDPR [4]) or by performing a re-identification risk assessment (e.g. Expert Determination for HIPAA, risk analysis assessment for GDPR). However, the well-defined methods are in most cases either too restrictive, leading to a poor useful dataset (e.g. GDPR, EMA Policy 0070) or too simplistic, leading to privacy concerns (e.g. HIPAA).

This paper proposes a practical and ready-to-use methodology to assess the risk of re-identification. Based on cybersecurity risk analysis methods, it is the first to consider the "feared event", and to introduce two new criteria - the severity of the event (additionally to its likelihood), and the exposure. The following sections position first our contribution against current approaches in Section 2, and then describes the method to compute severity (Section 3), likelihood (Section 4) and re-identification risk (Section 5). For illustration, we have an initial dataset in Table 1, and its anonymized versions using two techniques - k-anonymity and HIPAA - presented in Table 2 and Table 3. The objective is to apply our methodology to assess the risk.

<table><caption>**Table 1** Initial Dataset</caption><thead><tr><th>#</th><th>Age</th><th>Gender</th><th>Country</th><th>Admission Date</th><th>Blood Type</th><th>Disease</th></tr></thead><tbody><tr><td>1</td><td>23</td><td>M</td><td>Nigeria</td><td>2019-09-21</td><td>A+</td><td>Colds</td></tr><tr><td>2</td><td>23</td><td>M</td><td>Cameroon</td><td>2019-06-05</td><td>O+</td><td>Colds</td></tr><tr><td>3</td><td>25</td><td>M</td><td>Nigeria</td><td>2019-06-05</td><td>O+</td><td>Colds</td></tr><tr><td>4</td><td>32</td><td>F</td><td>France</td><td>2022-10-12</td><td>O+</td><td>Colds</td></tr><tr><td>5</td><td>31</td><td>F</td><td>France</td><td>2022-10-12</td><td>O+</td><td>Flu</td></tr><tr><td>6</td><td>37</td><td>F</td><td>Spain</td><td>2022-05-14</td><td>AB+</td><td>HIV</td></tr><tr><td>7</td><td>51</td><td>F</td><td>Canada</td><td>2021-04-01</td><td>AB-</td><td>Diabetes</td></tr><tr><td>8</td><td>53</td><td>F</td><td>USA</td><td>2021-04-01</td><td>O-</td><td>Cancer</td></tr><tr><td>9</td><td>53</td><td>F</td><td>Mexico</td><td>2021-04-01</td><td>B-</td><td>HIV</td></tr><tr><td>10</td><td>57</td><td>F</td><td>Canada</td><td>2022-04-01</td><td>B-</td><td>Colds</td></tr><tr><td>11</td><td>36</td><td>F</td><td>Belgium</td><td>2017-02-12</td><td>O+</td><td>Flu</td></tr><tr><td>12</td><td>30</td><td>F</td><td>Italy</td><td>2015-01-02</td><td>AB-</td><td>Flu</td></tr></tbody></table>
<table><caption>**Table 2** Anonymized Dataset - k-anonymity (k=3)</caption><thead><tr><th>#</th><th>Age</th><th>Gender</th><th>Country</th><th>Admission Date</th><th>Blood Type</th><th>Disease</th></tr></thead><tbody><tr><td rowspan="3">Group 1</td><td>2*</td><td>M</td><td>Africa</td><td>2019-**-**</td><td>Positive Rehsus</td><td>Colds</td></tr><tr><td>2*</td><td>M</td><td>Africa</td><td>2019-**-**</td><td>Positive Rehsus</td><td>Colds</td></tr><tr><td>2*</td><td>M</td><td>Africa</td><td>2019-**-**</td><td>Positive Rehsus</td><td>Colds</td></tr><tr><td rowspan="3">Group 2</td><td>3*</td><td>F</td><td>Europe</td><td>2022-**-**</td><td>Positive Rehsus</td><td>Colds</td></tr><tr><td>3*</td><td>F</td><td>Europe</td><td>2022-**-**</td><td>Positive Rehsus</td><td>Flu</td></tr><tr><td>3*</td><td>F</td><td>Europe</td><td>2022-**-**</td><td>Positive Rehsus</td><td>HIV</td></tr><tr><td rowspan="3">Group 3</td><td>5*</td><td>F</td><td>America</td><td>2021-**-**</td><td>Negative Rehsus</td><td>Diabetes</td></tr><tr><td>5*</td><td>F</td><td>America</td><td>2021-**-**</td><td>Negative Rehsus</td><td>Cancer</td></tr><tr><td>5*</td><td>F</td><td>America</td><td>2021-**-**</td><td>Negative Rehsus</td><td>HIV</td></tr></tbody></table>

<table><caption>**Table 3** Anonymized Dataset - HIPAA</caption><thead><tr><th>#</th><th>Age</th><th>Gender</th><th>Country</th><th>Admission Date</th><th>Blood Type</th><th>Disease</th></tr></thead><tbody><tr><td>1</td><td>23</td><td>M</td><td>Nigeria</td><td>2019-**-**</td><td>A+</td><td>Colds</td></tr><tr><td>2</td><td>23</td><td>M</td><td>Cameroon</td><td>2019-**-**</td><td>O+</td><td>Colds</td></tr><tr><td>3</td><td>25</td><td>M</td><td>Nigeria</td><td>2019-**-**</td><td>O+</td><td>Colds</td></tr><tr><td>4</td><td>32</td><td>F</td><td>France</td><td>2022-**-**</td><td>O+</td><td>Colds</td></tr><tr><td>5</td><td>31</td><td>F</td><td>France</td><td>2022-**-**</td><td>O+</td><td>Flu</td></tr><tr><td>6</td><td>37</td><td>F</td><td>Spain</td><td>2022-**-**</td><td>AB+</td><td>HIV</td></tr><tr><td>7</td><td>51</td><td>F</td><td>Canada</td><td>2021-**-**</td><td>AB-</td><td>Diabetes</td></tr><tr><td>8</td><td>53</td><td>F</td><td>USA</td><td>2021-**-**</td><td>O-</td><td>Cancer</td></tr><tr><td>9</td><td>53</td><td>F</td><td>Mexico</td><td>2021-**-**</td><td>B-</td><td>HIV</td></tr><tr><td>10</td><td>57</td><td>F</td><td>Canada</td><td>2022-**-**</td><td>B-</td><td>Colds</td></tr><tr><td>11</td><td>36</td><td>F</td><td>Belgium</td><td>2017-**-**</td><td>O+</td><td>Flu</td></tr><tr><td>12</td><td>30</td><td>F</td><td>Italy</td><td>2015-**-**</td><td>AB-</td><td>Flu</td></tr></tbody></table>

# 2 Background and Positioning against EU and US Legislations

## 2.1 Re-identification Risk Calculated based on two Criteria: Severity and Likelihood

As in cybersecurity risk assessment, e.g. EBIOS [5], we start by identifying the "feared event" for personal data, which falls into three categories: illegitimate access, unwanted modification, and disappearance of data [6] [7]. For re-identification, the "feared event" is simply "illegitimate access", as we are trying to prevent sensitive data from being disclosed to unauthorized persons. Once identified, the "feared event" is then assessed to provide a "severity level", i.e. the severity of the impact on individuals, which depends on the sensitivity of the data to be disclosed. For example, in Table 1, it is easy to re-identify User 3 and User 6, because they are unique within the table. The only people who have 25 and 37 are User 3 and User 6. However, the related feared event, the disclosure of their disease, is less severe for User 3, who has a Colds, than for User 6, who has HIV.

Contrary to the common definition of re-identification risk, which considers the attackers' ability [8] [9] [10] [11] and not severity, our methodology is inspired by
cybersecurity risk analysis, and defines two vulnerabilities - severity and likelihood - and the re-identification risk, as follows:

* **Severity (S):** Severity is related to the "feared event" and describes the impact on individuals if the "feared event" occurs. Severity in the context of re-identification reflects the sensitivity of the attributes to be disclosed and therefore, the impact on the individual if these sensitive attributes are disclosed.

* **Likelihood (L):** Likelihood is the probability that an attack will occur. The likelihood describes the attacker's ability to perform an attack and how vulnerabilities can be exploited to do so. It is assessed by the exploitability of such vulnerabilities inside the anonymized dataset (e.g. quasi-identifiers) and/or outside the anonymized dataset (e.g. flaws related to access control). The exploitability assesses how easy vulnerabilities can be used to link an individual to sensitive information.

* **Re-identification Risk (R):** Based on the EBIOS definition of risk, we define re-identification risk as the probability of associating sensitive information with an individual and having an impact on that individual. It is calculated based on the severity of such an impact on the individual, and the likelihood of the attack. R can be calculated as follows: $R = S \times L$.

Another point of interest in cybersecurity risk analysis, and one from which we can draw inspiration, is that it is not necessary to address all risks, but only the most important ones. Thanks to our methodology of assessing severity and likelihood at the attribute value level, this allows us to focus our attention on specific parts of the data, as shown in bold in Table 6.

## 2.2 Positioning our Contribution against Existing EU and US Legislations

The EU and US approaches to re-identification have some limitations, which are detailed in the following sections. Note that both of them limit the re-identification risk to the attacker's ability to perform an attack, i.e. the likelihood, and do not integrate the severity criterion (cf. Section 2.1).

### 2.2.1 US Approach Limitations

The risks considered by the US approach [12] [13] are:

* **Prosecutor risk:** the probability that a subject is unique in the dataset for an attacker who knows that the subject is in the dataset.

* **Journalist risk:** the probability that a subject is unique in the population from which the dataset was sampled. The attacker does not know if the subject is in the dataset and assumes that if he is unique in the population from which the dataset was sampled, then he is unique in the dataset.

* **Marketer risk:** the probability that each subject is unique in the dataset, the attacker is willing to identify as many subjects as possible. The risk of the journalist or the prosecutor is always greater than or equal to the marketer risk.
There are two main problems with the US approach to re-identification attacks. They do not allow a realistic assessment:

*   **The blur around the background knowledge:** For the journalist risk, the journalist is assumed to identify a population (background knowledge). The problem thus is how to correctly guess which population the attacker is using, given that any dataset from any source can be used, as long as it contains some of the attributes corresponding to those in the anonymized dataset, and the attacker has reason to believe that his target is within that dataset. It is therefore very difficult to quantify such a risk associated to very relative information.

=> **Our proposed methodology introduces the "Exposure" criterion to quantify the risk associated with a background knowledge.** Exposure depends only on the anonymized dataset and attribute types, and it assesses the ability of attributes to be found in other datasets (cf. Section 4.1).

*   **Re-identification occurs only with uniqueness:** the US approach considers that re-identification can only occur with uniqueness, which is not the case. In fact, the prosecutor's attack and the journalist's attack allow to compute the re-identification risk based on the equivalence class within the anonymized dataset (prosecutor attack) or within the population dataset (journalist attack). Indeed, the re-identification score is computed as the inverse of the size of the equivalence class, which is actually the probability related to unique values within the equivalence class [12]. The marketer risk uses a similar approach. However, there are cases where uniqueness is not necessary for re-identification. For example, Table 2, which is a 3-anonymity table, prevents by definition uniqueness. However, due to the lack of diversity for Group 1, it is enough to know that the target individual is in his twenties, to deduce that he suffers from "Colds". Therefore, in this case, the attacker does not need to find a unique individual, he only needs to find someone in his twenties for a complete re-identification (linkage with the information "Colds").

=> **Our proposed methodology suggests a new definition of re-identification based on the ability to associate a target with an information of interest,** as the goal of the attack is not only to make the target unique among others, but also to associate it with an information of interest (cf. Section 2.1).

### 2.2.2 EU Approach Limitations

The vulnerabilities (criteria) considered by EU in [4] are:

*   **Singling out:** the ability "to isolate some or all of the records that identify an individual in the dataset". For example, in Table 1, the value "37" of "Age" attribute isolates User 6 because he is the only one of that age in the dataset.

*   **Linkability:** the ability "to link at least two records concerning the same data subject or a group of data subjects (either in the same database or in two different databases)". For example, using the demographic attributes in Table 1 ("Age", "Gender", "Country"), we can link this dataset to an auxiliary dataset containing the same attributes concerning the same individuals.
* **Inference**: the ability "to deduce, with significant probability, the value of an attribute from the values of a set of other attributes". For example, in Table 1, all men "M" have "Colds".

We consider "Singling out" to be a special case of "Inference". In fact, "Singling out" is used to isolate an individual within the dataset, and this is a case of perfect inference of the sensitive information. For example, in Table 1, User 6 can be singled out by his age ("37"), and this is used to infer that he has "HIV". The more general case of inference is described in Table 2 where inference is performed through equivalence classes. For example, using Group 1, we can perform a different case of perfect inference, as all the individuals in this equivalence class suffer from "Colds". The other equivalence classes do not allow a perfect inference as they are well diversified.

=> **Therefore, our framework only considers "Inference" and "Linkability" for computing the likelihood of an attack** (cf. Section 4).

## 3 Computing the Severity (S)

Severity refers to the impact that disclosure of sensitive information could have on the individual, and this depends on the sensitivity of the attribute. For example, in Table 1, not all attributes have the same sensitivity because some may have more impact on the individual than others. For example, linking someone to a disease has a greater impact than linking them to their country or age as attribute "Disease" may reveal more compromising information about the individual. In addition, the difference in the sensitivity levels is also related to the specific values of the attributes. For example, for the "Disease" attribute, the value "Colds" is less sensitive than the values "HIV" or "Diabetes" because the latter two are serious diseases while the former is not. Our framework takes into account the severity of a risk based on the sensitivity of specific attributes and values.

To assess the sensitivity of a given attribute, we use the classification proposed by the French Data Protection Authority (CNIL) [14], which defines 3 types of effects on an individual, with 4 levels for each: negligible (level 1), limited (level 2), significant (level 3), maximum (level 4). The 3 types of effects are:

* Bodily: refers to the impacts related to the body of the individual (e.g. impairment of physical integrity as a result of an assault, domestic accident, work accident, etc.)

* Material: refers to the effects related to the material assets of the individual (e.g. insurance price increase, bank ban)

* Moral: refers to impacts related to moral issues (e.g. sense of invasion of privacy and irreparable harm, discrimination)

Based on this classification, we evaluate each of the attributes of Table 1 with the results provided in Table 4 and Table 5. In Table 4, only the attribute type is considered and a Global Severity level, ranging from 1 to 4, is calculated as the maximum of all sensitivity levels associated with each impact type. In Table 5, we focus on the values of the "Disease" attribute and assign the most sensitivity to the values "HIV" and "Cancer", as the disclosure of this information may have a greater impact on the individual. Based on these two tables, we can already propose a first assessment of the
initial Table 1. The resulting Table 6 highlights the entries that can have the greatest impact on individuals.

<table><caption>**Table 4** Severity Rating for Attribute Type - Initial Dataset</caption><thead><tr><th>Attributes</th><th>Bodily Impact</th><th>Material Impact</th><th>Moral Impact</th><th>Global Severity</th></tr></thead><tbody><tr><td>Age</td><td>1-Negligible</td><td>1-Negligible</td><td>1-Negligible</td><td>1-Negligible</td></tr><tr><td>Gender</td><td>1-Negligible</td><td>1-Negligible</td><td>1-Negligible</td><td>1-Negligible</td></tr><tr><td>Country</td><td>1-Negligible</td><td>1-Negligible</td><td>1-Negligible</td><td>1-Negligible</td></tr><tr><td>Admission Date</td><td>1-Negligible</td><td>1-Negligible</td><td>1-Negligible</td><td>1-Negligible</td></tr><tr><td>Bloody Type</td><td>1-Negligible</td><td>1-Negligible</td><td>1-Negligible</td><td>1-Negligible</td></tr><tr><td>Disease</td><td>1-Negligible</td><td>3-Significant</td><td>4-Maximum</td><td>4-Maximum</td></tr></tbody></table>

<table><caption>**Table 5** Severity Rating for Disease Attribute Values - Initial Dataset</caption><thead><tr><th>Values</th><th>Severity</th></tr></thead><tbody><tr><td>Colds</td><td>1-Negligible</td></tr><tr><td>Flu</td><td>1-Negligible</td></tr><tr><td>Diabetes</td><td>3-Significant</td></tr><tr><td>HIV</td><td>4-Maximum</td></tr><tr><td>Cancer</td><td>4-Maximum</td></tr></tbody></table>

<table><caption>**Table 6** Entries at Risk - Initial Dataset - Severity of Values carried by the Disease Attribute</caption><thead><tr><th>#</th><th>Age</th><th>Gender</th><th>Country</th><th>Admission Date</th><th>Blood Type</th><th>Disease</th></tr></thead><tbody><tr><td>1</td><td>23</td><td>M</td><td>Nigeria</td><td>2019-09-21</td><td>A+</td><td>Colds</td></tr><tr><td>2</td><td>23</td><td>M</td><td>Cameroon</td><td>2019-06-05</td><td>O+</td><td>Colds</td></tr><tr><td>3</td><td>25</td><td>M</td><td>Nigeria</td><td>2019-06-05</td><td>O+</td><td>Colds</td></tr><tr><td>4</td><td>32</td><td>F</td><td>France</td><td>2022-10-12</td><td>O+</td><td>Colds</td></tr><tr><td>5</td><td>31</td><td>F</td><td>France</td><td>2022-10-12</td><td>O+</td><td>Flu</td></tr><tr><td>6</td><td><strong>37</strong></td><td><strong>F</strong></td><td><strong>Spain</strong></td><td><strong>2022-05-14</strong></td><td><strong>AB+</strong></td><td><strong>HIV</strong></td></tr><tr><td>7</td><td><strong>51</strong></td><td><strong>F</strong></td><td><strong>Canada</strong></td><td><strong>2021-04-01</strong></td><td><strong>AB-</strong></td><td><strong>Diabetes</strong></td></tr><tr><td>8</td><td><strong>53</strong></td><td><strong>F</strong></td><td><strong>USA</strong></td><td><strong>2021-04-01</strong></td><td><strong>O-</strong></td><td><strong>Cancer</strong></td></tr><tr><td>9</td><td><strong>53</strong></td><td><strong>F</strong></td><td><strong>Mexico</strong></td><td><strong>2021-04-01</strong></td><td><strong>B-</strong></td><td><strong>HIV</strong></td></tr><tr><td>10</td><td>57</td><td>F</td><td>Canada</td><td>2022-04-01</td><td>B-</td><td>Colds</td></tr><tr><td>11</td><td>36</td><td>F</td><td>Belgium</td><td>2017-02-12</td><td>O+</td><td>Flu</td></tr><tr><td>12</td><td>30</td><td>F</td><td>Italy</td><td>2015-01-02</td><td>AB-</td><td>Flu</td></tr></tbody></table>
# 4 Computing the Likelihood (L)

As presented in Section 2.1, the likelihood is equivalent to estimating an attacker's ability to perform a re-identification attack, and thus his ability to link a given piece of sensitive information to an individual. As concluded in Section 2.2.2, he can carry out an inference attack and/or a linkability attack.

Assessing an attacker's ability to carry out these attacks is equivalent to assessing the exploitability of the quasi-identifiers, i.e. attribute types and values, available in the anonymized dataset to link the sensitive information to an individual. For example, in Table 3, this would consist of assessing the exploitability of the attributes "Age", "Gender", "Country", "Admission Date", and "Blood Type" to link an individual to the "Disease" attribute. This requires the two following components to be calculated separately: Exposure of Attributes (Section 4.1) and Inference (Section 4.2).

## 4.1 Exposure of Attributes (linkability)

Exposure of attributes evaluates the linkability vulnerability of an anonymized dataset, i.e. the attacker's ability to find an attribute in an auxiliary dataset for cross-referencing. In fact, not all attributes have the same linking potential; some are easier to use than others. For example, in Table 1, the quasi-identifiers "Age", "Gender", and "Country" are easier to use for linkage than the quasi-identifiers "Admission Date" and "Blood Type", as reported in Table 7. Indeed, the former can easily be found in an auxiliary dataset, as they are demographic data.

We define 4 levels of attribute exposure:

1. "Internal Restricted" (IR): Attributes related to specific operations that are not used outside of the context of those operations and are therefore difficult to find in another dataset (e.g. some medical test results, technical data, etc.).

2. "Internal Extended" (IE): Attributes used by several services within an organization, but not used outside the context of that organization (e.g. personnel number, department name, etc.).

3. "External Restricted" (ER): Attributes that can be found outside the organization but require in-depth research on social networks (e.g. smoker/non smoker, etc.).

4. "External Extended" (EE): Attributes that are widely used in different contexts and easily accessible from social networks or search engines (e.g. demographics, last name, first name, age, location data, etc.).

While the exposure levels highlight whether the attributes are widespread enough to perform a linking attack, they are not sufficient to capture the linkability vulnerability. Indeed, we should also consider the granularity of the attribute, which refers to the number of different values of the attribute. For example, in Table 1, while the attributes "Age" and "Gender" are both "EE", they do not share the same linkability level because the attribute "Age" is more granular (has more values) than the attribute "Gender", and is therefore easier to use for a linkage attack. The granularity of an attribute is captured by the "Singling out" vulnerability, which is already included in the inference vulnerability (see Section 2.2.2), so it does not need to be explicitly included in the likelihood computation.
<table><caption>**Table 7** Attributes
Exposure Assessment</caption><thead><tr><td>Attributes</td><td>Exposure</td></tr></thead><tbody><tr><td>Age</td><td>4-EE</td></tr><tr><td>Gender</td><td>4-EE</td></tr><tr><td>Country</td><td>4-EE</td></tr><tr><td>Admission Date</td><td>2-IE</td></tr><tr><td>Bloody Type</td><td>1-IR</td></tr></tbody></table>

## 4.2 Assessment of the Inference Vulnerability

The inference vulnerability is computed between the quasi-identifiers and the sensitive attribute to infer the values of the sensitive attribute using the quasi-identifiers. For example, in Table 1, the sensitive attribute is attribute "Disease", and using the attribute "Country", it is possible to guess some of the values of the attribute "Disease". For example, all people from "Nigeria" suffer from "Colds". Finally, we can combine different attributes to calculate the inference vulnerability. For example, all males "M" who are "23" suffer from "Colds" in Table 1.

To calculate the inference vulnerability, we use the Discrimination Rate (DR) metric [15, 16], which is based on the entropy, although other metrics may be used:

1. Weak: a DR between 0 and 0.25

2. Moderate: a DR between 0.25 and 0.5

3. Severe: a DR between 0.5 and 0.75

4. Critical: a DR between 0.75 and 1

The Discrimination Rate is used to quantify the extent to which quasi-identifiers values can discriminate the values of a sensitive attribute, with results between 0 and 1. DR = 1 means it is sufficient to know the quasi-identifier value to guess the sensitive value (e.g. Group 1 in Table 2). The DR also applies to combinations of quasi-identifier values.

<table><caption>**Table 8** Exploitability Assessment - k-anonymity</caption><thead><tr><td>Combined Attributes</td><td>Exposure</td><td>Inference</td><td>Exploitability</td></tr></thead><tbody><tr><td>Age/Gender/Country</td><td>4-EE</td><td>4-Critical</td><td>4-Very Easy</td></tr><tr><td>Admission Date/Blood Type</td><td>2-IE</td><td>4-Critical</td><td>3-Easy</td></tr></tbody></table>

## 4.3 Computing the Likelihood

Based on our proposed exploitability scale of Figure 1, we calculate the likelihood, i.e. exploitability, for the anonymized datasets: k-anonymity (Table 8 and Table 9) and HIPAA (Table 10 and Table 11). As indicated in bold, the highest risk corresponds to an attacker using the combined attributes "Age", "Gender" and "Country", or the individual attributes "Age" or "Country" to infer "very easily" the "Disease" attribute
<figure><img src="image_3.png" /><figcaption>Fig. 1 Our Exploitability Scale (Exposure/Inference)</figcaption></figure>

<table><caption>**Table 9** Exploitability Assessment - k-anonymity - Individual Attribute</caption><thead><tr><th>Attributes</th><th>Exposure</th><th>Inference</th><th>Exploitability</th></tr></thead><tbody><tr><td>Age</td><td>4-EE</td><td>4-Critical</td><td><strong>4-Very Easy</strong></td></tr><tr><td>Gender</td><td>4-EE</td><td>3-Severe</td><td><strong>4-Very Easy</strong></td></tr><tr><td>Country</td><td>4-EE</td><td>4-Critical</td><td><strong>4-Very Easy</strong></td></tr><tr><td>Admission Date</td><td>2-IE</td><td>4-Critical</td><td>3-Easy</td></tr><tr><td>Blood Type</td><td>2-IE</td><td>3-Severe</td><td>2-Difficult</td></tr></tbody></table>

of an individual, as the exposure level of these attributes are classified as "External Extended".

# 5 Computing the re-identification Risk

Based on our proposed re-identification risk scale of Figure 2, we assess the risk of re-identification for each anonymized datasets: k-anonymity (Table 12) and HIPAA (Table 13). Both resulting tables show that the risk of re-identification is critical for both datasets. This due to both the size of "k" in the k-anonymity Table 2, which is
<table><caption>**Table 10** Exploitability Assessment - HIPAA</caption><thead><tr><th>Combined Attributes</th><th>Exposure</th><th>Inference</th><th>Exploitability</th></tr></thead><tbody><tr><td><strong>Age/Gender/Country</strong></td><td>4-EE</td><td>4-Critical</td><td><strong>4-Very Easy</strong></td></tr><tr><td>Admission Date/Blood Type</td><td>2-IE</td><td>4-Critical</td><td>3-Easy</td></tr></tbody></table>

<table><caption>**Table 11** Exploitability Assessment - HIPAA - Individual Attribute</caption><thead><tr><th>Attributes</th><th>Exposure</th><th>Inference</th><th>Exploitability</th></tr></thead><tbody><tr><td><strong>Age</strong></td><td>4-EE</td><td>4-Critical</td><td><strong>4-Very Easy</strong></td></tr><tr><td><strong>Gender</strong></td><td>4-EE</td><td>3-Severe</td><td><strong>4-Very Easy</strong></td></tr><tr><td><strong>Country</strong></td><td>4-EE</td><td>4-Critical</td><td><strong>4-Very Easy</strong></td></tr><tr><td>Admission Date</td><td>2-IE</td><td>4-Critical</td><td>3-Easy</td></tr><tr><td>Blood Type</td><td>2-IE</td><td>4-Critical</td><td>3-Easy</td></tr></tbody></table>

<table><caption>**Table 12** Re-identification Risk Assessment - k-anonymity</caption><thead><tr><th>Description</th><th>Exploitability</th><th>Severity</th><th>Risk Level</th></tr></thead><tbody><tr><td><strong>Re-identification risk based on EE</strong></td><td>4-Very Easy</td><td>4-Maximum</td><td><strong>4-Critical</strong></td></tr><tr><td><strong>Re-identification risk based on IE</strong></td><td>3-Easy</td><td>4-Maximum</td><td><strong>4-Critical</strong></td></tr></tbody></table>

chosen very small (k=3) for illustration, and the fact that there is a perfect inference for Group 1. A larger "k" (usually k>11) would have provided a better level of security.

# 6 Conclusions

With the size of the data masking market estimated at $1.08 billion in 2025 and $2.14 billion by 2030 [https://www.mordorintelligence.com/industry-reports/data-masking-market], it is important to provide solutions to the enormous challenge posed by the field of database anonymization, especially in the healthcare sector, and the evaluation of such anonymization processing. The goal of this paper is to assist the industry with a practical and ready-to-use methodology, which is fully presented in this paper. The results are not presented in the form of a cut-and-dried yes or no answer, but provide more information for assessing risk and interpreting results, and therefore greater precision, with criteria that can be explained and made transparent.

This contribution also has enormous potential in that it can be used to improve anonymization techniques by identifying which attributes or attribute values to focus on in the anonymization process for greater efficiency and to avoid degrading attributes that have little impact on the re-identification risk.

This contribution not only provides a methodology for assessing privacy risks, but also paves the way for designing more accurate anonymization techniques that will help achieve a better trade-off between privacy and data utility.
<figure><img src="image_4.png" /><figcaption>**Fig. 2** Our Re-identification Risk Scale (Exploitability/Severity)</figcaption></figure>

<table><caption>**Table 13** Re-identification Risk Assessment - HIPAA</caption><thead><tr><td>Description</td><td>Exploitability</td><td>Severity</td><td>Risk Level</td></tr></thead><tbody><tr><td>Re-identification risk based on EE</td><td>4-Very Easy</td><td>4-Maximum</td><td>4-Critical</td></tr><tr><td>Re-identification risk based on IE</td><td>3-Easy</td><td>4-Maximum</td><td>4-Critical</td></tr></tbody></table>

# Declarations

## Ethical Approval

Not applicable.

## Funding

This research received no external funding.

## Availability of data and materials

Not applicable. The data provided in the tables is fictitious and invented by Louis-Philippe Sondeck for illustrative purposes only.
References

[1] US Department of Health and Human Services (HHS): Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (2012). https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html

[2] European Medicines Agency: External guidance on the implementation of the european medicines agency policy on the publication of clinical data for medical products for human use. Technical Report EMA/90915/2016, EMA (2018). https://www.ema.europa.eu/en/documents/regulatory-procedural-guideline/external-guidance-implementation-european-medicines-agency-policy-publication-clinical-data-medicinal-protection.pdf

[3] EU: Regulation (EU) 2016/679 of the European Parlament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (2016). https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679

[4] Article 29 Data Protection Working Party: Opinion 05/2014 on Anonymisation Techniques (2014)

[5] National Cybersecurity Agency of France (ANSSI): Ebios risk manager. Technical Report ANssiI-pA-048-EN, ANSSI (2019). https://cyber.gouv.fr/sites/default/files/2019/11/anssi-guide-ebios_risk_manager-en-v1.0.pdf

[6] Georgiou, D., Lambrinoudakis, C.: Dpia for cloud-based health organizations in the context of gdpr. In: ECCWS 2023 22nd European Conference on Cyber Warfare and Security (2023). Academic Conferences and publishing limited

[7] Seyyar, M.B., Geradts, Z.J.: Privacy impact assessment in large-scale digital forensic investigations. Forensic Science International: Digital Investigation 33, 200906 (2020)

[8] Benitez, K., Malin, B.: Evaluating re-identification risks with respect to the hipaa privacy rule. Journal of the American Medical Informatics Association 17(2), 169-177 (2010)

[9] Carey, C., Dick, T., Epasto, A., Javanmard, A., Karlin, J., Kumar, S., Muñoz Medina, A., Mirrokni, V., Nunes, G.H., Vassilvitskii, S., et al.: Measuring re-identification risk. Proceedings of the ACM on Management of Data 1(2), 1-26 (2023)

[10] Dankar, F.K., El Emam, K., Neisa, A., Roffey, T.: Estimating the re-identification risk of clinical data sets. BMC medical informatics and decision making 12, 1-15
(2012)

[11] El Emam, K., Jonker, E., Arbuckle, L., Malin, B.: A systematic review of re-identification attacks on health data. PloS one 6(12), 28071 (2011)

[12] El Emam, K., Dankar, F.K.: Protecting privacy using k-anonymity. Journal of the American Medical Informatics Association 15(5), 627-637 (2008)

[13] Dankar, F.K., El Emam, K.: A method for evaluating marketer re-identification risk. In: Proceedings of the 2010 EDBT/ICDT Workshops, pp. 1-10 (2010)

[14] Commission Nationale Informatique et Libertés: Analyse d'impact relative à la protection des données - Privacy Impact Assessment: Les bases de connaissances (2018). https://www.cnil.fr/sites/cnil/files/atoms/files/cnil-pia-3-fr-basesdeconnaissances.pdf

[15] Sondeck, L.-P., Laurent, M., Frey, V.: Discrimination rate: An attribute-centric metric to measure privacy. In: Annals of Telecommunications (2017)

[16] Sondeck, L.-P., Laurent, M., Frey, V.: The semantic discrimination rate metric for privacy measurements which questions the benefit of t-closeness over l-diversity. In: SECRYPT 2017: 14th International Conference on Security and Cryptography, vol. 6, pp. 285-294 (2017). Scitepress