id: "SI-19" title: "De-identification" family: "SI" family_name: "System and Information Integrity" sort_id: "si-19" priority: "P1" implementation_level: "system" enhancements: - si-19.1 - si-19.2 - si-19.3 - si-19.4 - si-19.5 - si-19.6 - si-19.7 - si-19.8
Remove the following elements of personally identifiable information from datasets: {{ insert: param, si-19_odp.01 }} ; and
Evaluate {{ insert: param, si-19_odp.02 }} for effectiveness of de-identification.
Guidance
De-identification is the general term for the process of removing the association between a set of identifying data and the data subject. Many datasets contain information about individuals that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother’s maiden name, or biometric records. Datasets may also contain other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. Personally identifiable information is removed from datasets by trained individuals when such information is not (or no longer) necessary to satisfy the requirements envisioned for the data. For example, if the dataset is only used to produce aggregate statistics, the identifiers that are not needed for producing those statistics are removed. Removing identifiers improves privacy protection since information that is removed cannot be inadvertently disclosed or improperly used. Organizations may be subject to specific de-identification definitions or methods under applicable laws, regulations, or policies. Re-identification is a residual risk with de-identified data. Re-identification attacks can vary, including combining new datasets or other improvements in data analytics. Maintaining awareness of potential attacks and evaluating for the effectiveness of the de-identification over time support the management of this residual risk.
Assessment Objective: {{ insert: param, si-19_odp.01 }} are removed from datasets;
Assessment Objective: the effectiveness of de-identification is evaluated {{ insert: param, si-19_odp.02 }}.
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
de-identification procedures
system configuration
datasets with personally identifiable information removed
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Organizational personnel responsible for identifying unnecessary identifiers
organizational personnel responsible for removing personally identifiable information from datasets
organizational personnel with information security and privacy responsibilities
Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements