Peter A Clarke

National Institute of Standards and Technology (the “NIST”) has released the second draft of its paper on the De identificatoin of Government Data Sets.  Given the recent introduction by the Federal Government of the problematical Privacy Amendment (Re – identification Offence) Bill 2016 it is a timely release. The NIST produces some world class work in the technical standards area. Given the proposed re identification prohibition will involve some considerable technical considerations, as well as determining what is the scope of intent, an element of the offence, this draft and the final product could be a useful resource.

NIST press release provides:

De-identification removes identifying information from a dataset so that the remaining data cannot be linked with specific individuals. Government agencies can use de-identification to reduce the privacy risk associated with collecting, processing, archiving, distributing or publishing government data. Previously NIST published NISTIR 8053, De-Identification of Personal Information, which provided a survey of de-identification and re-identification techniques. This document provides specific guidance to government agencies that wish to use de-identification.

In developing the draft Privacy Risk Management Framework, NIST sought the perspectives and experiences of de-identification  experts both inside and outside the US Government.

Future areas of work will focus on developing metrics and tests for de-identification software, as well as working with industry and academia to make algorithms that incorporate formal privacy guarantees usable for government de-identification activities. Collected input will be used to correct technical errors and expand areas that are unclear.