Anonymized Data: The Risks of Re-identification

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Anonymizing personal data is not always permanent, and the risk of re-identification is one of the greatest legal vulnerabilities in data due diligence.

What anonymized data is and why the LGPD treats it differently

Anonymized data is information that has gone through a technical process designed to remove, irreversibly, any possibility of linking it directly or indirectly to an individual. Article 12 of the Lei Geral de Proteção de Dados (LGPD, Brazil’s General Data Protection Law) provides that truly anonymized data is not considered personal data for purposes of the law. In theory, then, organizations may use this data freely for purposes such as research, market analysis and product development, without the restrictions that apply to the processing of personal data.

The LGPD itself, however, contains a key caveat: if the anonymization process can be reversed with reasonable efforts, the data is once again treated as personal data and becomes subject to every legal obligation. This concept of “reasonable efforts” is central to understanding the risks involved. Reasonableness is assessed in light of the current state of the art in technology, the costs involved, the time needed to reverse the process and the tools available when the re-identification is attempted. With technology evolving so quickly, techniques that seemed safe just a few years ago can become vulnerable to new algorithms and to the exponential growth in computing power.

Against this backdrop, the distinction between anonymization and pseudonymization becomes essential. Pseudonymization replaces direct identifiers with codes or keys, but it remains technically reversible for anyone with access to the lookup table. Anonymization, when done properly, should eliminate any path back to the data subject. In practice, many organizations confuse the two, treating merely pseudonymized data as if it were anonymized, and this creates significant legal exposure.

The main paths to re-identification in databases

Supposedly anonymized data can be re-identified in several ways, and understanding them is indispensable in any due diligence process. The first and most common is the linkage attack. Here, a malicious actor combines the anonymized database with other publicly available sources (such as voter rolls, social media, health databases or commercial records) to infer who the data subjects are. International academic studies have already shown that combining just three variables (date of birth, postal code and sex) can uniquely identify a significant share of the population in certain contexts.

The second major path is the inference attack, in which residual characteristics in the data make it possible to deduce information about specific individuals, even without identifying them directly. Take an anonymized medical database that contains information about a rare disease in a small town: the rarity of the condition alone may be enough to identify the patient, with no other data needed.

There is also the risk that comes from combining data over time. Even when each isolated “slice” of data seems safe, anonymized records accumulated over time can form behavioral patterns so specific that they work like fingerprints. Travel routes, spending patterns and browsing habits, when aggregated over time, can single out a person with a high degree of precision.

A fourth path that deserves attention in due diligence is re-identification through machine learning techniques. Modern machine learning algorithms can find subtle correlations in large volumes of data that escape human perception. Machine learning models trained specifically for re-identification can exploit residual statistical patterns that traditional anonymization techniques cannot fully eliminate.

Data due diligence: how to assess the strength of anonymization

In mergers, acquisitions, business partnerships and contracts with technology vendors, data due diligence has become a critical component. When assessing the quality of anonymization at a target organization, you need to look at several factors that go beyond a simple statement of compliance. The first step is to check which anonymization technique was used. Methods such as suppression (removing identifying fields), generalization (replacing specific values with ranges or categories), perturbation (adding statistical noise) and k-anonymity (ensuring that each record is indistinguishable from at least k-1 others) offer different levels of protection against re-identification attempts.

It is also important to determine whether there is technical documentation showing that re-identification tests were performed. An organization with a mature data protection program should be able to show that it subjected its anonymized databases to controlled reversal attempts using recognized methodologies. The absence of this documentation is, in itself, a red flag in any due diligence process. You should also check whether the organization keeps an up-to-date inventory of all databases that have been anonymized, recording the techniques applied, the processing dates and the technical staff responsible.

Anonymization is not a one-time event. It is an ongoing commitment that calls for periodic reassessment as technology evolves and new databases emerge that could serve as paths to re-identification.

Another key aspect is analyzing the data ecosystem in which the anonymized database sits. Even if the anonymization technique is technically sound on its own, the existence of other databases within the same organization (or accessible to its staff) that could be cross-referenced with the anonymized data significantly undermines the effectiveness of the process. For this reason, access controls, database segregation and data governance policies should all be part of the analysis.

Legal consequences of re-identification and who is responsible

When supposedly anonymized data is re-identified, the legal consequences can be severe. Under the LGPD framework, the data is once again treated as personal data from the moment reversal becomes possible (not only when it actually happens). This means that all processing carried out on the assumption that the data was anonymized may be deemed unlawful retroactively, with all the resulting penalties.

The ANPD (Brazil’s National Data Protection Authority) has the power to impose penalties that include warnings, fines of up to 2% of revenue (capped at R$ 50 million per violation), public disclosure of the violation, and the blocking and deletion of the personal data. In addition to administrative penalties, the organization responsible may face individual lawsuits and class actions brought by the affected data subjects, seeking compensation for moral and material damages. Under the LGPD, liability is strict in certain situations, which means the data subject does not have to prove fault.

In due diligence, uncovering weaknesses in anonymization can directly affect the risk assessment of the deal. Contingent data protection liabilities should be quantified and factored into the pricing of the transaction. Organizations with a history of re-identification incidents (or with anonymization practices known to be weak) tend to see their valuation drop in M&A transactions, reflecting the built-in regulatory risk. In addition, data-sharing agreements involving anonymized databases should include specific clauses prohibiting re-identification attempts, requiring notice in the event of incidents and clearly allocating responsibilities between the parties.

From a contractual standpoint, data processing agreements should include express warranties about the quality of the anonymization, with audit rights for the contracting party and an obligation to update the techniques whenever there is a relevant technological development. Including specific indemnification clauses for re-identification scenarios is also a prudent practice.

Best practices for reducing re-identification risks

To bring re-identification risks down to acceptable levels, a layered approach that combines technical, organizational and legal measures is recommended. On the technical side, differential privacy has proven to be one of the most promising approaches. This technique adds calibrated mathematical noise to the data so that statistical queries produce useful results without allowing individual records to be identified. Combined with generalization and suppression techniques, differential privacy offers formal guarantees against re-identification that go beyond traditional approaches.

On the organizational side, it is essential to set up a multidisciplinary committee (with professionals from technology, legal and compliance) responsible for periodically evaluating how effective the anonymization techniques in use are. This committee should monitor the state of the art in re-identification attacks, assess the organization’s exposure to new risk vectors and recommend process updates when needed. Ongoing training for the teams that handle anonymized data is also crucial to avoid operational errors that could compromise the effectiveness of the anonymization.

On the legal side, in addition to the contractual clauses mentioned above, it is advisable to prepare RIPDs (Relatórios de Impacto à Proteção de Dados Pessoais, or Personal Data Protection Impact Reports) specifically for anonymization processes, documenting the techniques used, the residual risks identified and the mitigation measures adopted. These reports serve both as an internal governance tool and as part of your defense in any ANPD inspection. Finally, clear retention and disposal policies ensure that anonymized data is not kept indefinitely, narrowing the window of exposure to future attacks driven by technological advances.

This topic is closely related to personal data on social media, which we cover in a separate article.

This topic is closely related to data from home IoT devices, which we cover in a separate article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.