The National Institute of Standards and Technology (NIST) recently released the final draft of its report on de-identification of personal information.

NIST reviewed various de-identification techniques for removal of personal information from computerized documents. De-identification techniques are widely used but existing techniques are insufficient to protect personal privacy because certain remaining information can make it possible to re-identify individuals, according to privacy experts. 

“Privacy protection improves as more aggressive de-identification techniques are employed, but less utility remains in the resulting dataset,” according to the report.

This final report follows NIST’s request for comments on its April 7 initial public draft. It offers an overview of the concepts of de-identification, re-identification and data sharing models; approaches for de-identifying structured data; and challenges of de-identification for non-tabular data, such as free-format text, images and genomic information.

The report concludes that although not perfect, de-identification is “a significant technical control that may protect the privacy of data subjects.” Also, there's a need for “standards and assessment techniques that can measurably address the breadth of data and risks” of de-identification.

Read the complete report.