‘Anonymized’ Credit Card Data Isn’t Really Anonymous

An article review.

Food for your ‘Privacy Policy’ Thoughts

A recent article from the Associated Press highlights a study that reviewed ‘anonymized’ credit card data. The MIT researchers were able to identify individuals based on their credit card actions alone.

With over ninety percent accuracy, the researchers were able to identify a person based on four credit card transactions, or only three transactions if the prices were available. The transactional metadata alone was enough of a trail that other time-stamped data could be used to positively identify the owner.

Fun Facts about the MIT study:

• Included 1.1 million people
• Three months of data were examined
• Data was collected from 10,000 shops
• Conducted in an undisclosed developed country

The article highlights the power of metadata along with the false sense of security that’s often present when ‘anonymized’ data is shared.

At infotex, we update our privacy policy every year. Now even if you aren’t an Audit Client of ours, we suspect that you’re probably doing the same. The question becomes: are we just going through the motions?

This article helps illustrate why we need to slow down and think about the implications of what we’re doing in light of both how the technology has changed and how the technology is used.

You might want to add this as a consideration in your vendor management as well.

Click Here To Read the Full Article

The above is what we call an “Article Review.” It is part of our attempt to help our readers find excellent reading materials to back up important technology risk management concepts. We try not to include articles that are merely news or additional news about mainstream issues. Instead, we try to highlight articles that our “typical clients” should be sure to read, or that are about concepts “outside the mainstream media.” infotex does not intend to endorse views represented by the writers of the articles we review, nor do we try to keep our Clients aware of EVERYTHING. For example, if a particular story concept is being reported upon in many different media sources, infotex usually chooses to ignore the story concept altogether, unless we can find a “unique take” on the story concept.

Original article by Seth Borenstein and Jack Gillum, Associated Press. Published by U.S. News & World Report.