version: "1.0.0" name: pseudonymization-risk description: >- Assessment of pseudonymization techniques and re-identification risk. Covers tokenization, hashing, encryption-based pseudonymization, and hybrid approaches. Includes re-identification risk scoring using the motivated intruder test, quantitative metrics (marketer, journalist, prosecutor models), and linkage attack resilience evaluation. References ENISA 2019 pseudonymization report. license: Apache-2.0 metadata: author: mukul975 version: "1.0" domain: privacy subdomain: privacy-by-design tags: "pseudonymization, re-identification, tokenization, hashing, enisa, motivated-intruder, linkage-attack"

Assessing Pseudonymization and Re-Identification Risk

Overview

Pseudonymization (GDPR Article 4(5)) means processing personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure non-attribution. Unlike anonymization (Recital 26), pseudonymized data remains personal data — but it significantly reduces risk and is explicitly recognized as an appropriate safeguard under Articles 25, 32, and 89.

The ENISA report "Pseudonymisation Techniques and Best Practices" (November 2019) provides a comprehensive taxonomy of pseudonymization techniques and their properties. This skill implements a structured assessment framework for selecting appropriate techniques and quantifying residual re-identification risk.

Pseudonymization Techniques Taxonomy

Technique 1: Counter-Based Pseudonyms

Prism Data Systems AG Implementation: Customer IDs are replaced with UUIDv4 pseudonyms at the analytics ingestion boundary. The mapping table is stored in a separate HSM-backed database accessible only to the DPO and the identity resolution service (which requires dual-approval access).

Technique 2: Cryptographic Hashing (HMAC)

Risk: Plain SHA-256 hashing (without key) is vulnerable to rainbow table attacks on low-entropy identifiers like email addresses. HMAC with a secret key mitigates this but the key becomes the single point of re-identification.

Prism Data Systems AG Implementation: HMAC-SHA256 with a 256-bit key rotated quarterly is used for pseudonymizing user identifiers in the analytics pipeline. The HMAC key is stored in AWS KMS with access restricted to the pseudonymization service account. Key rotation triggers re-pseudonymization of the active analytics dataset.

Technique 3: Encryption-Based Pseudonymization

Format-Preserving Encryption preserves the format of the original identifier (e.g., encrypting a 10-digit phone number produces another 10-digit number), enabling pseudonymization without schema changes.

Prism Data Systems AG Implementation: FPE (FF3-1 mode) is used for pseudonymizing phone numbers and IBAN fields in the support ticket system. This allows Tier 1 support agents to see structurally valid but pseudonymized identifiers, reducing accidental exposure while maintaining workflow compatibility.

Technique 4: Tokenization

Prism Data Systems AG Implementation: Payment card data is tokenized using a PCI DSS-compliant token vault. The vault is operated by the payment processor and is logically separated from Prism's infrastructure. Detokenization requires a PCI-scoped service account with transaction-level authorization.

Technique 5: Synthetic Data Replacement

Use case: Test environments where referential integrity must be maintained but no re-identification path is acceptable.

Technique Comparison Matrix

Re-Identification Risk Assessment Framework

The Motivated Intruder Test

The UK Information Commissioner's Office (ICO) Anonymisation Code of Practice defines the motivated intruder test: would a reasonably competent, motivated person with access to resources such as the internet, public libraries, and public records be able to identify an individual from the pseudonymized data?

Assessment Factors:

Quantitative Risk Models

Prosecutor Model

The attacker knows a specific individual is in the dataset and attempts to find their record. Risk = 1 / k, where k is the size of the equivalence class containing the target record.

Journalist Model

The attacker does not know if the target is in the dataset but attempts to re-identify any individual for a story. Risk = max(1/k) across all equivalence classes (the smallest group is most vulnerable).

Marketer Model

The attacker attempts to re-identify as many individuals as possible. Risk = (1/n) * Σ(1/k_i) — the average re-identification probability across all records.

Linkage Attack Categories

Risk Scoring Methodology

Step 1: Technique Assessment (0-100)

Score the pseudonymization technique on five properties:

Step 2: Data Environment Assessment (0-100)

Score the data environment on re-identification risk factors:

Step 3: Residual Risk Score

Residual Risk = Data Environment Risk × (1 - Technique Score / 100)

Prism Data Systems AG — Assessment Summary

The research exports flow received a "Moderate" classification due to the combination of rich quasi-identifiers in the exported dataset and the counter-based technique's susceptibility to record linkage. Remediation: apply l-diversity (l≥3) on sensitive attributes and generalize quasi-identifiers to achieve k≥11 before export.

Key Regulatory References

• GDPR Article 4(5) — Definition of pseudonymization
• GDPR Recital 26 — Anonymization vs. pseudonymization distinction
• GDPR Article 25(1) — Pseudonymization as a data protection by design measure
• GDPR Article 32(1)(a) — Pseudonymization as a security measure
• GDPR Article 89(1) — Pseudonymization for research processing safeguards
• ENISA "Pseudonymisation Techniques and Best Practices" (November 2019)
• ICO Anonymisation Code of Practice — Motivated intruder test
• Article 29 Working Party Opinion 05/2014 (WP216) on Anonymisation Techniques
• EDPB Guidelines 4/2019 on Article 25 — Pseudonymization as by-design measure