How To Break Anonymity of the Netflix Prize Dataset

'Anonymisation' schemes are a little like encryption, in that they just get monotonically weaker over time as people work out attacks. But the attacks tend to be much worse. I work in academic open data publishing, and the netflix prize (https://arxiv.org/abs/cs/0610105) hangs over our heads. But what this illustrates to me is that researchers are just really careless, despite everything we make them agree to in data transfer agreements. It seems absurd to have little cubicles like this https://safepodnetwork.ac.uk/ (think Mission Impossible 1) but I do despair.

We should have learned this lesson 20 years ago when researchers were able to deanonymize a lot of the Netflix Prize dataset, which contained nothing except movie ratings and their associated dates. https://arxiv.org/abs/cs/0610105 If movie ratings are vulnerable to pattern-matching from noisy external sources, then it should be obvious that location data is enormously more vulnerable.

LOL. I'm not going to deanonymize datasets for an internet stranger. Certainly not for free, but also not at any hourly rate unless I know that the organization employing me either has the original non-anonymized dataset or at least have very strict internal controls about how deanonymized data will be handled. (I also haven't done this work in a LONG time, and there's now a whole lot of academic work on the topic that didn't exist back then, so there are probably much better consultants for legitimate organizations looking to hire for this work.) If you want proof, you can use google to find LOTS of papers along these lines analyzing real datasets. I think https://arxiv.org/pdf/cs/0610105.pdf is a fairly typical example.

You're perhaps right. Of course, these people are on things like Facebook, Twitter and blogs and if you can narrow down age, gender, location and medical condition, you might be able to correlate with public posts. You can also look for specific people in there if you have certain kinds of prior information about them: For example, Aravind Narayanan was able to de-anonymize some part of the Netflix set [http://arxiv.org/abs/cs/0610105]. Maybe that won't translate to this data.