# Collecting, Processing and Secondary Using Personal and (Pseudo)Anonymized Data in Smart Cities
## 4 Smart City De-Anonymization and Re-Identification Use Cases
### Geolocation Data  
Leaking users' location information can allow a range of attacks by malicious individuals, ranging from physical surveillance and stalking to identity theft. Another risk is that of inferences from sensitive information. Location data is a strong target for attackers, as it allows direct access to citizens' personal lives, allowing them to know where they have been and for how long, giving the ability to perceive daily habits and use that information for targeted attacks like stalking and spear-phishing. For example, if an individual's location information indicates a hospital, in this case, the data already suggests a series of information related to the place and healthcare, for example, diseases, opening hours, profession and visits to acquaintances, among others. Location-based services such as parking spot finders disclose not only spatio-temporal user data, but also user queries. The notion that individuals implicitly consent to being monitored when moving in public space is worrying because the lack of alternatives means that consent cannot be meaningfully withheld. There are other things that may seem harmless but that can result in the identification of a person. Let us imagine an open-data system that shows the information about the real-time location of the electric scooters publicly available, even when they are being driven: this imposes a risk to the privacy, and even security, of the citizens who use this type of transportation. This is an example of information that, if correlated, can lead to the re-identification of a person. Geolocation is very present in our lives, especially with the adoption of numerous IoT devices that accompany us 24/7. At the moment, we have wearables that, many of them, already come with GPS that can always be on or, at least, during physical exercise such as a running workout. For example, in November 2017, sensitive information about the location and staffing of military bases and spy outposts around the world was revealed by a fitness tracking company. In this case, population density or user density was so low that those facilities could be identified for lack of other data points nearby [7]. The details were released by Strava in a data visualization map that shows all the activity tracked by users of its app, which allows people to record their exercise and share it with others [120]. In this case, it is a matter of security and privacy breach rather than direct re-identification. However, if we think about all the other data that the bracelet will record (heartbeat, daily habits and other personal information), it is possible to arrive at the re-identification of the specific individual, since the spectrum of people who, for example, would be within the base, would already be restricted. More specifically, there are many studies of re-identification of individuals through the analysis of location data. In 2013, researchers in Europe studied the location data of 1.5 million people and found that the data was so specific to individual habits that they could identify 95% of people with just four location data points [121]. Many of these data are stored in databases. We know that the IoT collects a lot of data, mainly geolocation, and this can lead to the re-identification of people, even without the individual names or identifiers. The authors of [122] described an investigation of the sensitivity of a dataset with taxi trips without identifiers. The dataset included pick-up location, drop-off location and time, without the names of individuals. The authors claim that, in the investigation, the researchers found photos of celebrities getting into taxi cabs and used metadata from those photos to match up with starting times and locations in the taxi dataset. With this, researchers found the drop-off location of those individuals, getting their home addresses. This means that any large database can expose PII, when combined with other data and other datasets. Anonymization and de-identification techniques attempt to remove PII from datasets.