Towards Privacy by Design in Learner Corpora Research: A Case of On-the-fly Pseudonymization of S wedish Learner Essays (2020)

Abstract: This article reports on an ongoing project aiming at automatization of pseudonymization of learner essays. The process includes three steps: identification of personal information in an unstructured text, labeling for a category, and pseudonymization. We experiment with rule-based methods for detection of 15 categories out of the suggested 19 (Megyesi et al., 2018) that we deem important and/or doable with automatic approaches. For the detection and labeling steps,we use resources covering personal names, geographic names, company and university names and others. For the pseudonymization step, we replace the item using another item of the same type from the above-mentioned resources. Evaluation of the detection and labeling steps are made on a set of manually anonymized essays. The results are promising and show that 89% of the personal information can be successfully identified in learner data, and annotated correctly with an inter-annotator agreement of 86% measured as Fleiss kappa and Krippendorff’s alpha.

## introduction access to language data is an obvious prerequisite for research in digital humanities in general, and the development of nlp-based tools in particular. however, accessible data becomes a challenging target where personal data is involved. this is very true of language learner data where tasks are often phrased so that they -directly or indirectly -elicit explicit personal information, e.g. "describe your school" or "introduce yourself". the recent public debate -starting with edward snowden's revelations of us government's abuse of personal integrity -has led to important changes in european legislation @xcite @xcite as well as in attitudes towards sharing and collection of data online. the general data protection regulation (gdpr) has come timely in relation to this debate. gdpr is a legal european regulation restricting the use of digital data containing personal information. article 4 in gdpr defines personal information as any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (eu commission, 2016, art.4). among others, the gdpr focuses on handing back the ownership of personal data from software providers to private people (data subjects). however, the risks of misuse may linger despite the legislation, and the best protection would be either not to provide any personal information at all (which often is impossible), or to make sure that the software implementation encrypts, masks, hides or totally prevents any personal information to enter servers (thus preventing its potential unauthorized exploitation). technology that could safeguard data subjects in that respect -that is, various deidentification/pseudonymization techniques, alongside with encryption, authorization, data minimization etc. -are recommended to be built into the software from the start, ensuring that the software complies with the requirement of data protection by design and by default @xcite . gdpr states that anonymous data, that is, data that is de-identified in such a way that no reidentification is possible, falls outside the scope of the gdpr @xcite . however, no data is truly anonymous and is said to be an unattainable target @xcite . pseudonymization, on the other hand, is recognized by the gdpr as one of the ways (and a requirement) to reduce risks of re-identification of a data subject @xcite . pseudonymization is effective if data cannot be attributed to a specific data subject without use of any additional information. the additional information should, then, be kept separately from the rest of the data. while the potential landscape of privacy-protecting techniques is huge (e.g., see an overview in @xcite ), our experiment focuses on a limited domain of learner corpora, zooming into one technique, namely, pseudonymization. in the absence of labeled pseudonymized data to apply dataintensive machine learning approaches, we choose to experiment with rule-based approaches to detect, label and pseudonymize information that we define as personal on a set of l2 swedish essays. we use resources for names, geographic names, work and study places, etc. some linguistic, common knowledge and certain task-related constraints are handled, such as polysemy between personal names and geographic names, and some morphological markers. below we present the reasoning around the pseudonymization process, the first experiments, results and analysis. we view our experimentation with rule-based pseudonymization techniques as the first building block of a "privacy by design" platform for online essay collection. ## related work there is not much published literature on the topic of de-identification of personal information in language data in general, and no detailed studies of anonymization/pseudonymization methods using nlp technology. de-identification of personal information through anonymization and/or pseudonymization got most attention in the medical domain where personal information is removed or masked in medical data sets to guarantee the anonymity of patients. however, few studies have been carried out on de-identification applied to other areas where language data is used. before the age of gdpr, one of the earliest and most comprehensive studies on anonymization was presented by @xcite . she gave an overview of anonymization methods, and legal rights, responsibilities, and obligations when using texts in corpora. later @xcite presented a study on nlp and anonymization where he introduced a publicly-available benchmark corpus along with an interactive model for anonymizing data based on syntactic analysis and active learning. he defined anonymization as "the task of identifying and neutralizing sensitive references within a given document or set of documents". following @xcite , anonymization in current studies usually involves two distinct steps: first the text sequence containing personal information is identified, and then neutralized. neutralization can be performed either by the replacement of the personal information with a placeholder, a category type of the personal information, or by another similar token belonging to the same category type. since the gdpr legislation, we have seen an increased interest in the nlp community to deal with automatic pseudonymization, see e.g. the recent workshop on nlp and pseudonymisation @xcite . still, most of the literature on the topic deals with medical data, e.g. @xcite , with available gdpr guidelines such as "identifiability, anonymisation and pseudonymisation" published by the medical research council (mrc, 2019). ## experiment setup the experiment has been carried out within the swell project, aiming at building a digital infrastructure for research on swedish as a second language (l2), including compilation of a digital corpus of essays @xcite . in connection to that, intensive work is ongoing with collection and manual annotation of essays written by adult l2 learners of swedish, planned for release in 2021. one of the steps includes pseudonymization of essays, performed manually at this stage. to experiment with the potential of automatic pseudonymization, we opted for a rule-based approach, which was motivated by the fact that very few manually pseudonymized essays were available at that moment (85 for the first evaluation, and 200 for the second) which excluded the application of dataintensive machine learning approaches. however, we do not rule out a future possibility to get enough manually annotated data for training machine learning algorithms for this problem. the automatic pseudonymization 1 is implemented in python and is split into three subsequent steps: (1) detection of personal segments (section 3.3), (2) labeling of categories (section 3.4) and (3) pseudonymization (section 3.5), see figure 1 for an overview. during the detection step, regular expressions, contextual triggers, resource lookup and matching strings to lists are used. minor spelling correction based on levenstein distance is also applied to some categories. during the category labeling step a hypothesis is generated about which categories an identified segment can belong to, and where necessary, disambiguated using contextual triggers, information on part of speech, or frequency. during the pseudonymization step, the identified categories are either replaced with potential candidates of the same type, e.g. names -with new names; or are replaced with a standard variant representing the category, e.g. url.com for all urls. we associate individual rules with each of the 15 categories (and their sub-categories). to analyze, whether the rules could identify and effectively replace sensitive data points, we compare the detected segments and the labels in the manually annotated versions and ours, and report the accuracy. the pseudonymizer service has been incorporated into the demo version of svala, the swell annotation tool used in the project @xcite , for better visualization and manual inspection. ## results during the first evaluation, we observed that the automatic pseudonymization performed more reliably in narratives, argumentative and instructional texts, but failed in investigative and evaluative genres. on manual inspection and comparison of the two modes of pseudonymization, we noted that in investigative and evaluative genres personal information is practically never used. we observed the following: evaluative texts are based on book and film reviews with plenty of names (person, places) without any reference to the author of the essay. thus, the human annotator did not consider labeling the passages, whereas the automatic service followed the same principles despite the topic change. investigative texts are usually based on a newspaper article and the writer discusses different aspects of the topic touched in the article. this entails references to names, places and various facts that do not reveal the writer's identity, but most often point to some famous political or cultural figures. like with evaluative texts, texts of this genre could potentially be exempt from pseudonymization. care should be taken, though, when mentions of first person personal pronouns take place (e.g. in vietnam, we...). for the second evaluation, we have updated the pseudonymizer service and added a version which consults automatically assigned parts of speech for improved disambiguation. we can see that the pseudonymizer service in both its variants is quite close to the human annotation numbers for all genres ( false negatives, on the other hand, can reveal weaknesses in the rules, e.g. lack of coverage of the underlying resources, failure of the rules to capture some specific cases, or inability of the algorithm to identify sensitive personal data due to misspellings. if no manual control is applied, false negatives can set the author of the essay to serious risk of being identified. in the future, challenges with spelling (and other) errors need to be addressed alongside with questions around whether errors and grammatical forms used by the learners need to be projected to pseudonyms. pseudonymized version of a text represents a manipulated -and presumably more protectiveversion of an original text. an important question in connection to this is what is more important: that a pseudonymized text reads like an original, or that it is obvious that the text is pseudonymized? language teachers and assessors within the swell project have been unanimous about keeping clear identifiers of all text segments that have been manipulated in order not to mistake pseudonyms for learner's production. for this reason, we have not considered the need to conceal pseudonyms. on the contrary, we keep all pseudonymized segments clearly highlighted. this attitude seems, however, to be domain dependent. in medical domain, for example, publications reveal an intention to pseudonymize medical records in such a way so that no one using the data would suspect which sections are pseudonymized. for example, @xcite describes an evaluation procedure of pseudonymization where human evaluators are given the task to identify which of the medical records are pseudonymized, and which are not. if pseudonymized texts are taken for being orignal ones, this is taken as a sign of a high quality of pseudonymization. however, the current paradigm has been shifting from hiding the fact of pseudonymization towards actually pointing out which text segments have undergone careful examination to hide revealing personal information. in light of this, possible consequences of linguistic infelicities that pseudonymization might introduce into the texts seem to be minor compared to the risk of getting access to an original. for the sake of readability, however, pseudonymized texts need to retain the same level of (natural) flow, as well as grammatical and semantic coherence. the latter aspects present non-inconsiderable challenges. a number of unstructured data points that might be attributed to a person through context are still left outside the scope of this work (e.g. when i was four i climbed up a mango tree in my uncle's garden and fell off. i have scars and limp since then.), as are misspelled names that cannot be matched to the resources we are using. even though the gdpr (eu commission, 2016, recital 15) admits that where personal data is stored in an unstructured way it might not be covered by the gdpr, the ethical restrictions still apply. in connection to which we double-check all essays manually to identify such cases. in the future, we will test automatization of that part of the work as well. to summarize, use of pseudonymization holds two strong benefits in the research context: compliance with gdpr and permission to use data beyond the original purposes of collection. however, pseudonymized data is still personal data, and needs to be protected in further ways, such as encryptions, authorizations, etc. in the future, we would like to test machine learning for this problem, and to test crowdsourcing for correction of automatic pseudonymization with the ultimate goal to start collecting learner essays online with a secure on-the-fly pseudonymization.