What did Latanya Sweeney's research demonstrate about the re-identification risk from quasi-identifiers?
Sweeney showed that 87% of the US population can be uniquely identified using just three quasi-identifiers: full date of birth, 5-digit ZIP code, and gender — proving that removing names alone is insufficient for anonymization.
The research finding:
- 87% of US citizens — 216 million of 248 million people in the 1990 census — are uniquely identifiable by the combination of {full birth date, 5-digit ZIP code, gender}
- This means removing someone's name from a dataset provides almost no privacy protection if these three fields remain
- The fix is generalization: coarsening to {birth year, ZIP, gender} drops unique identifiability to about 0.04% — the same level the US HIPAA "Safe Harbor" de-identification standard targets
A caveat worth knowing: a later replication on the 2000 census (Golle, "Revisiting the Uniqueness of Simple Demographics") found a lower figure — about 63% uniquely identifiable by the same three fields — but the headline 87% remains the canonical, widely-cited number and the point stands: a handful of quasi-identifiers re-identifies most people.
How re-identification by linking works:
- Take an "anonymized" dataset (e.g., hospital records with names removed but birth date, ZIP, and gender intact)
- Obtain a public dataset containing the same quasi-identifiers (e.g., voter registration records which include name + birth date + ZIP + gender)
- Link the two datasets on the shared quasi-identifiers
- Result: names are now attached to the "anonymized" medical records
Real-world demonstration: Sweeney famously re-identified the medical records of Massachusetts Governor William Weld by linking anonymized health insurance data with publicly available voter registration records.
Tip: When evaluating whether a dataset is truly anonymized, always ask: "Could these remaining fields be cross-referenced with any other available dataset to re-identify individuals?"
Go deeper:
Latanya Sweeney (Wikipedia) — the Weld re-identification and the 87% finding.- Data re-identification (Wikipedia) — linkage attacks and the de-anonymization literature.