Metadata Can Expose Person's Identity Even Without Name

New Analytic Formula Identifies People Without Names, Account Numbers

Your shopping habits can expose who you are even when you are just one of a million nameless customers in a database of anonymous credit-card records, according to a new study that shows how so-called metadata can be used to circumvent privacy protections in commercial and government databases.

Researchers at MIT analyzed anonymous credit-card 
transactions by 1.1 million people and could identify 
90% of the people involved using just four pieces of 
secondary information such as location or timing

Researchers at the Massachusetts Institute of Technology, writing Thursday in the journal Science, analyzed anonymous credit-card transactions by 1.1 million people. Using a new analytic formula, they needed only four bits of secondary information—metadata such as location or timing—to identify the unique individual purchasing patterns of 90% of the people involved, even when the data were scrubbed of any names, account numbers or other obvious identifiers.

“We are introducing a way to find what you need to identify an individual—how much data makes you stand out in the crowd,” said MIT data analyst Yves-Alexandre de Montjoye, who led the study. “This touches on the fundamental limit of anonymizing data.”

Researchers drew on records of purchases over a period of three months by shoppers at 10,000 stores, provided by an unnamed bank in an undisclosed country. Each transaction was time-stamped with the day of purchase and linked to a shop.

Even with so little to go on, they could readily identify a person’s unique purchasing pattern. “We did everything you would need to do to find a person in the data, but we did not try to attach a specific name to it,” Mr. de Montjoye said.

After isolating a purchasing pattern, researchers said, an analyst could find the name of the person in question by matching their activity against other publicly available information such as profiles on Linkedin and Facebook , Twitter messages that contain time and location information, and social-media “check-in” apps such as Foursquare.

Read the rest of the story HERE.

If you like what you see, please "Like" us on Facebook either here or here. Please follow us on Twitter here.