How is "identity" formally defined in the context of privacy and data protection?

According to Petrlic & Sorge (2017), an identity is the set of attribute values that sufficiently distinguishes a subject from all others within a given context.

Key aspects of this definition:

• Set of attributes — An identity isn't a single piece of data but a collection of characteristics
• Sufficient distinction — Only enough attributes to tell one person apart from another are needed
• Context-dependent — What counts as an identity changes with context (your student ID at university vs. your passport at the border)

Examples:

Important distinction: Your identity is not just your name — it's whatever combination of attributes uniquely identifies you in a given system. This is why even "anonymized" datasets can sometimes be re-identified: enough quasi-identifiers together can recreate an identity.

Go deeper:

• Digital identity (Wikipedia) — attribute-set identity and its digital projection.