Re-identification Risk of Online Data Repositories

Abstract

The intention of this project was to highlight and hopefully raise awareness of the importance of data protection to people who wish to make their data available to others by investigating the reidentification risk of openly available datasets and to facilitate the investigation of this for others. We investigated the disclosure risk of datasets kept in online data repositories at both the file and record levels using the Data Intrusion Simulation (DIS) method for the file level disclosure risk, and the DIS adjusted Special Uniques Detection Algorithm (DIS-SUDA) method for the record level disclosure risks. We analysed 209 datasets from 2017 across 4 Dataverses within The Dataverse Project, namely The Australian Data Archive Dataverse (28 files), The Harvard Dataverse (113 files), Scholars Portal Dataverse (21 files), and the UNC Dataverse (47 files). We found disclosure risks were generally very low with only a few datasets which had very high disclosure risks. The very high disclosure risks were due to the inclusion of direct identifying variables or very specific geographic information. We found no evidence of differences of disclosure risks between datasets intended for publication and those not (p-value = 0.509). However, we found evidence of difference between the Dataverses with the Australian Data (ADA) Archive having higher file disclosure risks than the other three Dataverses (p-values all 0). The ADA Dataverse has methods to ensure both Safe people and Safe projects so therefore they can accept a higher disclosure risk. We have laid out a framework to assist both industry professionals and academics in investigating both file and record level disclosure risks. The disclosure risk calculation methods and statistical disclosure control techniques we suggest are reasonably simple to implement and understand for people across a wide range of industries and disciplines. The disclosure risks at both the file and the individual level for datasets stored in online data repositories are reasonably low, except in a few cases. Care should always be taken whenever uploading data and many existing public datasets may have high disclosure risks.