Re-identification risk in a 'privacy-safe' telematics dataset for city planners
MoveIQ sells fleet telematics. It plans to publish a 'privacy-safe' open dataset of 1.2 million trips for municipal congestion planning. Each row has a hashed device ID, start and end coordinates rounded to 100 metres, start and end timestamps to the minute, vehicle type, and trip distance. MoveIQ removed names, phone numbers and emails and calls the dataset anonymous. A university researcher shows that four trips by the same hashed ID, combined with public residential maps, re-identifies 18% of drivers' home locations; night-shift workers at a single factory are especially exposed. The city wants street-level data; sales wants the dataset live in six weeks; the privacy office has not been consulted. MoveIQ's consumer notice says data may be used for 'research and urban planning' but does not mention public release.
1. Is the dataset anonymous in law and practice? What follows if it is not?
Read the worked answer
It is unlikely to be anonymous. Removing names and phone numbers is not enough. The dataset retains a persistent hashed device ID and precise trip patterns; the researcher has shown that four trips plus public maps re-identify a substantial share of drivers. Under the reasonably-likely-means test, that is pseudonymised personal data, not anonymous data. The hash is a keyed or unkeyed link that MoveIQ or a recipient may be able to reverse or link to other data.
If it is personal data, DPDP obligations attach to the publication: lawful basis, notice, purpose limitation, security and the data principal's rights. The notice mentions research and urban planning but not public release, so the purpose has changed. The publication is a disclosure to the world, including advertisers and insurers, not just to the city. Anonymisation must be assessed against the recipient's likely means, not just MoveIQ's. Treat the dataset as personal data until a documented re-identification assessment proves otherwise.
2. What technical measures could reduce re-identification risk while preserving enough utility for congestion planning?
Read the worked answer
Use a combination, and test the output against realistic attackers:
- Remove the persistent device ID or replace it with a per-release random token that cannot be linked across releases.
- Aggregate to grid cells and publish counts or averages rather than individual trips, with a minimum cell threshold and suppression of small cells.
- Coarsen time to hour or peak/off-peak bands, and generalise coordinates to a larger grid or road segment.
- Top/bottom-code distance and suppress rare vehicle types or routes.
- Apply differential privacy noise to counts and flows, with a documented privacy budget.
- Separate sensitive slices: publish night-shift factory flows only in aggregate, or withhold them.
- Re-identification testing before and after release, including linkage with public maps and census data.
There is a utility trade-off: street-level data is exactly what creates the risk. Offer the city a controlled-access version for finer analysis and a public version with stronger protection.
3. What governance and contractual steps should accompany the release?
Read the worked answer
Run a DPIA before release and record the re-identification assessment, the utility trade-off and the decision-maker. Update the consumer notice if public release is to continue, and check whether the existing consent or other basis covers it; 'research and urban planning' is not a clear basis for open publication. Give drivers a route to object where applicable.
Contract with the city: purpose limitation, no re-identification, no onward publication, security requirements, breach notification, deletion, and audit or compliance reporting. If researchers get access, use a data-use agreement, a safe room or a trusted-research environment rather than open download.
Internally, establish a release review board with privacy, security, legal and product; document the k-anonymity or differential-privacy parameters; and schedule annual re-identification testing. Sales should not set the six-week date until the DPIA and testing are complete.