ISO/IEC 20889:2018

Privacy enhancing data de-identification terminology and classification of techniques

This document provides a description of privacy-enhancing data de-identification techniques, to be used to describe and design de-identification measures in accordance with the privacy principles in ISO/IEC 29100. In particular, this document specifies terminology, a classification of de-identification techniques according to their characteristics, and their applicability for reducing the risk of re-identification. This document is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, that are PII controllers or PII processors acting on a controller's behalf, implementing data de-identification processes for privacy enhancing purposes.

Terminologie et classification des techniques de dé-identification de données pour la protection de la vie privée

General Information

• Status: Published
• Publication Date: 05-Nov-2018
• ICS: 35.030 - IT Security
• Technical Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Drafting Committee: ISO/IEC JTC 1/SC 27/WG 5 - Identity management and privacy technologies
• Current Stage: 9060 - Close of review
• Start Date: 04-Jun-2029

Standards Content (Sample)

INTERNATIONAL ISO/IEC
STANDARD 20889
First edition
2018-11
Privacy enhancing data de-
identification terminology and
classification of techniques
Terminologie et classification des techniques de dé-identification de
données pour la protection de la vie privée
Reference number
ISO/IEC 20889:2018(E)
©
ISO/IEC 2018

---------------------- Page: 1 ----------------------
ISO/IEC 20889:2018(E)

COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2018
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting
on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address
below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Fax: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii © ISO/IEC 2018 – All rights reserved

---------------------- Page: 2 ----------------------
ISO/IEC 20889:2018(E)

Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms . 5
5 Overview . 6
6 Technical model and terminology . 6
7 Re-identification . 8
7.1 General . 8
7.2 Re-identification attacks . 8
8 Usefulness of de-identified data .10
9 De-identification techniques .10
9.1 Statistical tools .10
9.1.1 General.10
9.1.2 Sampling.10
9.1.3 Aggregation .11
9.2 Cryptographic tools.11
9.2.1 General.
...