# Collecting, Processing and Secondary Using Personal and (Pseudo)Anonymized Data in Smart Cities
## 3 Background Concepts
### Key Terminology
**De-anonymization** is a data mining strategy in which anonymous data is cross-referenced with other data sources to re-identify the anonymous data source. Any information that distinguishes one data source from another can be used for de-anonymization. Although this concept goes back several decades, the term made headlines in 2006 when [PERSON] and [PERSON] entered a contest hosted by Netflix, a popular movie-rental service. [PERSON] and [PERSON] [34] applied their de-anonymization methodology to a dataset that contained the anonymous movie ratings of 500,000 members and were able to identify Netflix data for several specific members successfully. However, the authors emphasized that de-anonymization requires abundant, granular and fairly stable data across time and context. **Re-Identification** is the reverse process of de-identification, i.e., data re-identification occurs when personally identifying information is discoverable in de-identified data. The number of re-identification attacks has grown tremendously in recent years. Professionals with experience in the field have realized that removing direct identifiers cannot guarantee correct de-identification [35]. Furthermore, re-identification of personal information is easier and cheaper than ever before, with new databases useful for linking constantly available [36]. According to [PERSON] [37], de-identified (i.e., \"pure\" de-identified, anonymized or pseudonymized) data can be re-identified through three methods: insufficient de-identification, pseudonym reversal, and combing or linking datasets. Insufficient de-identification occurs when a direct or indirect identifier inadvertently remains in a dataset made available to the public. Pseudonym reversal explores poor de-identification mechanisms that rely on a key that is kept to reverse the process, that use the same pseudonym for a specific individual for a too long period or for which the method used to assign pseudonyms is discovered. Finally, combining or linking one piece of data from the de-identified dataset with other datasets may be enough to reveal the person's real identity. The author also notes these techniques are not mutually exclusive. [PERSON] [38] introduced some metrics to quantify the probability of re-identification. These parameters can be applied in datasets or simply in personal information. The probability of re-identification depends on two elements: the number of quasi-identifiers (QIDs) included in the dataset and how disturbed the data is; and the disclosure of information. In general, the more QIDs there are in the available data, the easier the re-identification process [39]. For non-public data, it is essential not to neglect the possibility of a person trying to re-identify an individual in the dataset. The authors in [38,39] developed a methodology based on subjective probability to classify the probability of re-identifying personal data. The method returns a probabilistic value based on risk. [PERSON] and [PERSON] [40] demonstrated in 1997 that 87% of Americans could be re-identified if the date of birth, gender and zip code are provided within a data source. They used a voter register and linked the data sources together to deduce individuals. Several years later, the Facebook myPersonality app published data along with the date of birth, gender and zip code. Therefore, the published data of the myPersonality app was only pseudonymized, but not anonymized.