Graphing the sensitive boundary between personally identifiable information and publicly inferable insights
Sleuthing is the art of making intelligent inferences from sparse, disconnected and seemingly random data. Detectives, like any skilled analyst, are adept at using these inferences to solve real-world problems. Analysis is a profession that often demands ingenuity in how you play with the data that comes into your possession.
When analysts encounter sensitive data, they must be careful not to play fast and loose with it. As the European Union’s General Data Protection Regulation compliance deadline approaches, many enterprises are revisiting their procedures for analyzing, storing and protecting customers’ personal data. Privacy is serious business. Rather than assume that all customer data is fair game for them to explore, analysts must observe the bounds of what uses the customer has explicitly opted into.
GDPR strongly protects personally identifiable information, or PII, that’s maintained in digital data stores of all sorts. To that end, enterprises everywhere, not just in EU member states, are investing in platforms and tools to beef up privacy protections as a standard operating procedure that involves:
But these sorts of procedures may be of little use in stopping a determined analyst from using sophisticated tools to infer insights about a person that are not recorded as specific facts about them in any database, or that are available for the taking if you know how to correlate two or more public data sources.
That’s the privacy issue behind one of this week’s big stories: the apprehension of a suspect in the decades-old “Golden State Killer” case. In a nutshell, the suspect in many murders was fingered after a team of investigators tracked him down through correlation of crime-scene DNA with a publicly accessible family-genetics database. From a privacy standpoint, what was most noteworthy about this case is how it proceeded through careful correlation of publicly available information, with only a smidgen of personally identifying DNA evidence that fell short of the traditional scope of PII.
Over the decades since the “Golden State Killer” crimes were committed, investigators had come up short in useful leads, having exhausted the potential of criminal DNA databases, crime-scene fingerprints and informant tips. So they took an alternate route to an answer: using the suspect’s DNA from a duplicate crime-scene evidence kit as a key to searching for the killer through family connections in a publicly accessible family-genetics database service. They took the following steps to finger the suspect:
What relevance does this have to GDPR or any other privacy protection regulation? Privacy can be difficult to safeguard when anybody can conceivably put two and two together without access to PII.
There is a fuzzy boundary between information that’s personally identifiable and insights about persons that are publicly inferable. GDPR and similar mandates only cover protection of discrete pieces of digital PII that that are maintained in digital databases and other recordkeeping systems. But some observers seem to be arguing that it also encompasses insights that might be gained in the future about somebody through analytics on unprotected data. That’s how I’m construing David Loshin’s statement that “sexual orientation [is] covered under GDPR, too.”
My pushback to Loshin’s position is to point out that it’s not terribly common for businesses or nonprofits to record people’s sexual orientation, unless an organization specifically serves one or more segments of the LBTGQ community — and even then, it’s pointless and perhaps gauche and intrusive to ask people to declare their orientation formally as a condition of membership. So it’s unlikely you’ll find businesses maintaining PII profile records stating that someone is gay, lesbian, bisexual or whatever.
