privacydocs.github.io

Topic Pages - De-Identification

(Extracted and updated from a list initially compiled for the Canadian Anonymization Network)

Regulators / Government

Canada

• Information and Privacy Commissioner of Ontario – De-Identification Guidelines for Structured Data (June 2016)

United States

• Department of Health and Human Services – Guidance Regarding Methods for De-Identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (November 2012)
• California Health and Human Services Agency – Data De-Identification Guidelines (September 2016)

Europe

• Article 29 Working Party – Opinion 05/2014 on Anonymization Techniques (April 2014)
• United Kingdom Information Commissioner’s Office – Anonymisation: managing data protection risk code of practice (March 2015)
  • Update: Chapter 1 (in consultation)
  • Update: Chapter 2 (in consultation)
• Ireland Data Protection Commission – Guidance on Anonymisation and Pseudonymisation (June 2019)
• Norway Datatilsynet (Norwegian DPA) – A Guide to the Anonymisation of Personal Data (2015)
• Spanish Agency for Data Protection (AEPD) and European Data Protection Supervisor – Introduction to the hash function as a personal data pseudonymization technique (October 2019)

Asia

• Japan’s Personal Information Protection Commission Secretariat – Anonymously Processed Information: Towards Balanced Promotion of Personal Data Utilization and Consumer Trust (February 2017)
• Korea (Multiple Agencies) – Guidelines for De-Identification of Personal Data (June 2016)
• Singapore Personal Data Protection Commission
• Guide to basic data anonymisation techniques (January 2018)
• Advisory Guidelines on the Personal Data Protection Act for Selected Topics – Chapter 3, Anonymisation (August 2018)

Oceania

• Office of the Australian Information Commissioner – De-identification and the Privacy Act (March 2018)
• Office of the Victoria Information Commissioner – Protecting unit-record level personal information – The limits of de-identification and the implications for the Privacy and Data Protection Act 2014 (May 2018)
• Victorian Centre for Data Insights – De-identification Guideline (February 2018)

Standards Bodies

• NIST Internal Report (NISTIR) 8053 – De-Identification of Personal Information (October 2015)
• NIST Special Publication (SP) 800-188: De-Identifying Government Data Sets (December 2016)
• NIST Privacy Engineering Collaboration Space – De-Identification Tools (Updated March 2021)
• ISO/IEC 20889:2018 – Privacy enhancing data de-identification terminology and classification of techniques
• ISO 25237:2017 – Health Informatics – Pseudonymization

Other Organizations

• Canada – CHEO Research Institute / Electronic Health Information Library – Pan-Canadian De-Identification Guidelines for Personal Health Information (April 2007)
• United States – Future of Privacy Forum – A Visual Guide to Practical De-identification (April 2016)
• United States – DataSF (City and County of San Francisco’s Official Open Data Portal) – Open Data Release Toolkit (November 2016; includes a toolkit to assess the release of de-identified sensitive or protected datasets on the open data portal)
• United Kingdom – UK Anonymisation Network – Anonymisation Decision-making Framework (2016)
• Australia – Data61 / Commonwealth Scientific and Industrial Research Organization – The De-Identification Decision-Making Framework (September 2017)

---

To suggest new topics, identify additional resources, report broken links, etc., please contact vance at datapolicy.ca

Last updated: October 24, 2021