Data Anonymisation

Data anonymisation is an issue in almost all software development teams who I have worked with. High-quality representative data is needed for all types of software testing, and forethought on how this may be produced, and the effort involved, is often overlooked in the rush to publish live code. This can be particularly problematic where the data contains more sensitive information such as personal data, where the use for testing may have not explicitly been given by the data subject.

Data anonymisation, along with encryption and tokenisation, are often misunderstood and wrongly thought to be a simple fix for some aspects of data protection. Also, it is not solely an issue for testing purposes; data may need to be anonymised for operational logging, reporting & statistical analysis, and during archival/warehousing of information at the end of its active life, but prior to final disposal. Care needs to be taken with data anonymisation, and therefore I was pleased to see the UK's Information Commissioner's Office will be holding a Seminar on Privacy and Data Anonymisation on 30th March 2011 to discuss different approaches, difficulties and risks.

Appropriately the event is being held at The Welcome Trust on Euston Road in London, since this is a particularly relevant topic in the medical sector. But don't dismiss the topic out-of-hand as only of use for "sensitive data". This affects all types of data — personal or not — and the provisional programme emphasizes this with contributions from the Cabinet Office, the Universities of Manchester and Southampton, the Office of National Statistics and the Market Research Society. Also speaking is Paul Ohm (University of Colorado) who I had mentioned in a previous posting about test data, and I'd recommend reading his paper I referenced there. Perhaps I would have liked to see a presentation from someone in the financial services sector too since, apart from being high-volume personal data processors, anonymisation can also play a part in fraud prevention.

The ICO wants to encourage representation at the seminar from a range of sectors, and asks for potential attendees to register their interest. I hope commercial trade organisations and other regulators will attend and participate.