# The Interface of Privacy and Data Security in Automated City Shuttles: The GDPR Analysis
## 4 The Interface of Privacy and Data Security in ACSs
### Privacy-Preserving Techniques Overview
#### 4.1.2 Anonymization  
The anonymization technique is where both identifiers and keys are removed and the link between individuals and their locations is concealed for identity perturbation purposes [53]. It is considered as a solution to permanently remove personal data leading to identification of a natural person [7]. Recital 26 excludes anonymous information from the GDPR scope as it is assumed to be a long-lasting and irreversible solution. Similarly, the ePrivacy Directive [10] emphasizes erasing or anonymizing traffic and location data within the vehicular communications (Article 6(1) and Article 9(1)).Despite the best efforts on removing identifiers or even the keys, privacy can still be compromised [46]. There is a wide spectrum of anonymization techniques that can be applied to protect vehicular data, but their definitions are noticeably overlapping and commonly mistaken [49]. Data randomization (also called noising) and data generalization are the core anonymization families according to opinion 05/2014 of the WP29 [35]. Researchers discussed multiple _randomization_ approaches that vary from noise addition, differential privacy, and swapping, to masking. _Noise addition_ occurs when an appropriate and proportionate noise is added to randomly modify the sensitive data [31]. Applied to location data, noise addition would result in falsifying, for example, the exact differential Global Positioning Systems (GPS) coordinates with an additional 10 km. Although, with some knowledge about the other dataset's attributes, an attacker can filter out the noise or link it to another database to regenerate the missing information [35]. Differential privacy is a different approach of noise addition that can be applied to larger datasets with the promise of learning useful information about a population while the individual's privacy is conserved. By adding random noise to a set of data before learning from it, private inputs are hidden without impacting the result accuracy [54]. However, simple efforts would lead to inferring or predicting individuals and/or location attributes [55]. Swapping, also called permutation, is a randomization technique that leads to falsifying a data entry by shuffling personal information within a dataset. Although, if a dataset has redundant attributes, the permutation will not be efficient and will lead to potential failure of the intended anonymization goals [35]. _Data masking_ is frequently considered as a further randomization technique that refers to the process of hiding true values to make the sensitive information inconceivable, such as by replacing characters with asterisks [49]. Nevertheless, data masking remains a generic term that refers to the process of hiding true values [33], which at the end can refer to pseudonymization or anonymization [56]. The key measure to classify data masking as either an anonymization or a pseudonymization scheme is the eventual reversibility property. According to the GDPR (Recitals 28 and 29, Article 4(5)) [7], a reverted process is considered as a pseudonymization technique which, unlike anonymization, makes it subject to different legal provisions and additional technical and organization efforts from data controllers. Therefore, in our view, we consider data masking to be a parent node for pseudonymization and anonymization, as depicted in Figure 4. This reflects how easily misunderstandings about the anonymization techniques can lead to unintentional unlawful processing [45]. _Generalization_ is when the attribute's value is substituted with a broad but semantically logical value [57]. Applied to personal data within the automated driving system, generalization can replace the specific location data with a broad city or country name. Such techniques are implemented by generalizing or diluting the identifiers in a way that replaces the week instead of the day and the country instead of a city location [35].