IEEE P3477

New IEEE Standard - Active - Draft.


This standard specifies an evaluation methodology to assess the re-identification risk following the application of anonymization processes to data intended for sharing. Specifically, the elements contributing to re-identification risks are described, which encompass threats to processed data, security measures implemented for the processed data, and potential impacts on the data subject. Furthermore, this standard provides a method for evaluating the levels of re-identification risk based on these considerations, and a comprehensive evaluation procedure. The application of the methodology across common data sharing scenarios, such as internal data sharing, external data sharing, and data publishing, is also described.
Data providers, data recipients, anonymization service providers, and regulation agencies can employ this standard's methodology to evaluate whether the anonymization measures taken are sufficient and effective. Moreover, based on the evaluation results, whether further anonymization is necessary can be determined. The evaluation methodology can also serve as a basis for independent assessments conducted by third-party organizations.