Is Anonymity Anonymous if It's Easy to Deanonymize?

Technology obviously makes possible the highest levels of surveillance and record keeping and information matching and data mining that the world has ever known.  We mostly depend on social and legal controls to keep this capacity in check, but we also employ technical controls (which could be thought of as the equivalent of locks and safes and such).  Paul Ohm suggests that the folks who think about the legal and social controls have not been paying enough attention to that state of the art in locks and lock picking.  This abstract is from SSRN -- the full paper should be available there too.

Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization

Paul Ohm
University of Colorado Law School
August 13, 2009

University of Colorado Law Legal Studies Research Paper No. 09-12

Abstract

Computer scientists have recently undermined our faith in the privacy-protecting power of anonymization, the name for techniques for protecting the privacy of individuals in large databases by deleting information like names and social security numbers. These scientists have demonstrated they can often 'reidentify' or 'deanonymize' individuals hidden in anonymized data with astonishing ease. By understanding this research, we will realize we have made a mistake, labored beneath a fundamental misunderstanding, which has assured us much less privacy than we have assumed. This mistake pervades nearly every information privacy law, regulation, and debate, yet regulators and legal scholars have paid it scant attention. We must respond to the surprising failure of anonymization, and this Article provides the tools to do so.