Re:Dell Computers Has Been Hacked
by manigandham on Tuesday January 05, 2016 @10:25AM
(#10843669)
There is a difference. Yes search results can reveal a lot, even just a few hundred likes on Facebook can reveal your entire personality [1]. However this data is not regulated the same as actual personal information like names, address, gov id numbers, credit card data, etc. even though it should be.
The protection of the law does add to the security. Also anonymization of the PII (scrubbing into just a serial number) combined with the dilution of purchases into larger categories provides lots of protection. Your google search history is lot more detailed and granular than most of the purchase data you can buy through data markets. You might be able to figure out a basic "profile" and maybe use lookalike modeling but it would be incredibly difficult to actually distill that to a discrete person.
There's also been a push to buy "insights" rather than just data to get more ROI with less effort/cost so instead of buying purchase histories you would just buy a segment of people interested in buying washing machines for example.
Agreed. I work on pharmacy data, which is additionally subject to HIPAA compliance. While the the pharmacy data does technically not contain anything identifiable, it is frightening how easily someone can match their own company's records up to a data set that is supposedly anonymous.
But we've seen how useless even apparently well meaning anonymisation is—think of the AOL search results. I can't imagine how utterly useless it becomes when it is done by people in whose interest it is to do it poorly, while remaining just within the law.