Formalizing Anonymity for Software Development

Abstract

While anonymity is often considered as a binary property that is either satisfied or not satisfied, a closer analysis shows that there are different degrees of anonymity and that an appropriate degree of anonymity must be selected depending on application and context. For this purpose, different models have been developed that allow for defining the degree of anonymity needed for a given application and evaluating whether this required degree has been achieved. The current paper identifies the properties that such a model of anonymity should satisfy and evaluates the most common models based on these properties, thereby providing a basis for implementing anonymity in software development and verifying that an adequate degree of anonymity has been achieved in a particular application. To achieve this, the paper starts with an outline of the reasons for creating anonymity models and the legal framework of anonymity. Subsequently, the main threats to and relevant properties of anonymity are identified. In the main body of the paper, the available models of anonymity are then summarized and evaluated against these properties.

1. Introduction

1.1. Anonymity

The concept of anonymity is increasingly becoming the focus of research in software development, with two major sub-areas to be distinguished. On the one hand, anonymity exists in the context of communication, that is, the question of whether users can communicate and act unrecognized; on the other hand, there is anonymity in data processing, that is, the question of whether individuals can remain anonymous in data sets and their processing. This paper discusses the latter, analysing how the concept of anonymity can be modelled as a basis for implementing anonymity in information systems and conforming to relevant data protection or privacy regulations. The main reason for using such models of anonymity is that even though most legal regulations present anonymity as a binary property, there are actually different degrees of anonymity; thus, models for defining and evaluating these different degrees are necessary.

Legislation aims to protect data subjects and their privacy from uncontrolled data processing and the potential discrimination and harm that may result from it [1,2]. To do so, it distinguishes between personal and anonymous (including anonymized) data. Often, legislation does not define anonymous data as such but instead defines personal data (also called personally identifying information, or PII), thereby indirectly outlining the scope of anonymous data (i.e., data that are not included in the definition of personal data). In this context, there is usually no systematic distinction between data and information; instead, both terms are used synonymously. For example, see Definition 4 for the definition of personal data. Importantly, these terms are defined differently depending on the source, even within different legislation (see Section 2.1), which can potentially lead to uncertainty in implementation of the relevant regulations and laws.

Parallel to the normative definition of anonymity and influenced by these developments, interpretations of anonymity have emerged in the technical environment that not only diverge within the field ([3], pp. 6–10) but also show deviations from the legal interpretation. The increasing importance of data processing in everyday life also influences our normative and ethical understanding of the term. Technical definitions are shaped by the question of feasibility, while legal definitions are shaped by ethical and normative principles.

The main use case of anonymization concerns situations where an organization has collected or wants to collect a set of personal data and wants to analyse these for statistical properties, where the identity of the data subjects is not relevant. In order to protect the privacy of these data subjects and satisfy relevant legislation, the organization tries to remove the link between the data and the data subjects, ideally without loss of utility regarding their statistical analysis of the data. Hölzel describes this as a “well-known legal loophole” ([4], p. 184) to escape the regulatory burdens of GDPR. Depending on context, the results may then be used internally or even made publicly available, for example in the case of medical studies or census data.

The use of anonymization is closely related to privacy-enhancing techniques (PET) [5], also known as privacy-preserving techniques; see, e.g., [6]. These are techniques that can be used to process personal data while at the same time preserving the privacy of these data. The main difference is that with most PETs the data remain as personal data; privacy is enhanced by restricting access to the data, including the party that processes them (e.g., as in homomorphic encryption or secure multi-party computation). However, there is some overlap between both topics and some anonymization models, in particular differential privacy (see Section 3.2), which are also considered as PETs.

1.2. Research Goals

This paper aims to clarify where the need for modelling anonymity comes from, how the achieved anonymity can be evaluated, and what limitations need to be considered. This is intended to help software developers adequately implement anonymization in their work.

In the past, it has been shown on several occasions that mechanisms for preserving the anonymity of individuals that were considered reliable at the time were in fact vulnerable to attacks [7,8,9]. The main attack vectors are presented in this paper as examples. Whether and how protection against future unknown attacks can be ensured is discussed later in this paper. The attack vectors are contrasted with a selection of mechanisms designed to ensure anonymity which are not only respected in technical research but also endorsed in legal documents and regulations.

Based on the work described above, this paper investigates different approaches to modelling the concept of anonymity and compares them based on identified criteria. The aim is to describe anonymity from different perspectives and support developers in selecting the appropriate model for any specific application. In the further course of this paper, the limitations and shortcomings of the concept of anonymity are examined along with their impact on its implementation in the development of software systems.

The analysis is restricted to models of anonymity for structured data, i.e., textual and numeric data; other types of data, such as video and audio, are not included in the analysis.

1.3. Methodology

The work described here is based on a literature study, starting with a review of the relevant normative literature. The main body of the paper is based on a search for formal models of anonymity as well as criteria for evaluating such models. The anonymity models are then evaluated based on the identified criteria.

A model of anonymity is included in the analysis if it defines the concept of anonymity, ideally supporting the quantification of the degree of anonymity achieved or achievable in a certain context. Such quantification of the degree of anonymity helps to balance the achieved degree of anonymity against the loss of information that usually goes with anonymization. Models that define privacy rather than anonymity, for example, contextual integrity [10], are not included in the analysis. The search for models of anonymity very quickly converged towards the set of models covered in this paper; therefore, a systematic literature review was not deemed necessary.

In order to evaluate these models, suitable criteria are needed. However, the relevant legal sources do not explicitly state any criteria that could be used for this purpose, beyond that it must be sufficiently difficult to identify the person to whom the data refer (see Section 2.2 below). Therefore, we instead collect evaluation criteria from previous descriptions of the models and the arguments provided in their favour. Criteria are included where they are considered generally applicable and not designed specifically in reference to an individual model.

2. Theoretical Foundations

This section discusses the fundamental concepts, then analyzes the concept of anonymity and establishes its connection to privacy and data protection. This is followed by an introduction to various data protection rights and explanations of relevant terms.

2.1. The Concept of Anonymity

The term “anonymous” comes from the Greek $\mathsf{\alpha }\mathsf{\nu }\mathsf{\omega }\mathsf{\nu }\mathsf{\upsilon }\mathsf{\mu }o\mathsf{\zeta }$ (“anónymos”), meaning “nameless, unknown”. However, the term “anonymity” did not enter common usage until much later. According to its origin, the word refers to “not being known, not being named, namelessness” and was originally used in the sense of authorship [11] (p. 97). Today, anonymity is understood as non-identifiability, as for example defined in ISO/IEC 29100 [12].

Definition 1 (Anonymity).

Characteristic of information that does not permit a personally identifiable information principal to be identified directly or indirectly. (ISO/IEC 29100:2024, Definition 3.1).

To achieve anonymity, data may have to be anonymized:

Definition 2 (Anonymization).

Process by which personally identifiable information (PII) is irreversibly altered in such a way that a PII principal can no longer be identified directly or indirectly, either by the PII controller alone or in collaboration with any other party. (ISO/IEC 29100:2024, Definition 3.2).

Analysis of anonymity has shown that it is difficult to formally describe anonymity of data alone; therefore, most of the formalization approaches discussed in this paper refer to anonymization mechanisms. Such anonymization mechanisms include, for example, the removal of identifying data, statistical analysis of datasets, or randomization and generalization processes (see Section 2.4), rather than the anonymity of a dataset.

As mentioned before, personal data (in ISO/IEC 29100 called PII) are data that are not anonymous.

Definition 3 (Personally identifiable information (PII) (according to ISO/IEC 29100)).

Information that (a) can be used to establish a link between the information and the natural person to whom such information relates, or (b) is or might be directly or indirectly linked to a natural person. (Definition 3.7, ISO/IEC 29100:2024 ).

The GDPR (EU General Data Protection Regulation, available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32016R0679 (accessed on 25 May 2026) contains a similar but more detailed definition.

Definition 4 (Personal data (according to GDPR)).

Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. (Art. 4 (1) GDPR).

The main differences between the different definitions are on a more detailed level, concerning how much effort and previous knowledge is needed for establishing such a link or relationship, e.g., as discussed in Section 2.2.1 below.

In some contexts, there is a distinction between “normal” personal data and “sensitive” data such as health data, where anonymization is likely to be more important. However, this distinction is relevant for the application of the formalization and different levels of anonymity, not for the definition of these concepts as discussed in this paper.

The definitions above refer to the two central roles involved in the discussion of anonymity and PII.

Definition 5 (PII principal (data subject)).

Natural person to whom the personally identifiable information (PII) relates. (ISO/IEC 29100:2024, Definition 3.9).

Definition 6 (PII controller).

Privacy stakeholder (or privacy stakeholders) that determines the purposes and means for processing personally identifiable information (PII) other than natural persons who use data for personal purposes. (ISO/IEC 29100:2024, Definition 3.8).

When discussing data (or information) that allow for the identification of individuals, the concepts of identifiers and quasi-identifiers are required. For simplicity, we assume that the data are available as a table consisting of records, in which each record represents an individual and consists of different attributes.

Definition 7 (Identifier).

Attribute (or set of attributes) that can be used to uniquely identify individuals (records) in a dataset.

Definition 8 (Quasi-identifier (QI)).

Set of non-sensitive attributes that enables uniquely identifying at least one individual (p. 330 in [13]; [14]).

The concepts of anonymity and anonymization are mainly relevant in the discussion of privacy or data protection. But what is the connection between these concepts and anonymity? What significance do data protection laws have in this context?

As early as 1890, Warren and Brandeis published an essay that dealt with the right to privacy [15]. In the 1950s, the European Convention on Human Rights (ECHR) provided for a “Right to respect for [one’s] private and family life” which may only be interfered with under certain restrictive conditions (Art. 8 ECHR). Similar statements about the right to privacy can be found in many constitutions and related documents; example include the Fourth Amendment to the US Constitution and the German Grundgesetz (Basic Law).

2.2. Relevant Legal Sources

This section presents a selection of relevant sources of legal standards for this work. The difference between the various definitions of personal data vs. anonymous data mainly concerns the conditions under which identification of individual persons is possible or impossible, e.g., how much effort is involved and which other data are available. As a result, this leads to different levels of anonymity.

2.2.1. The EU General Data Protection Regulation

The EU’s General Data Protection Regulation (GDPR) regulates the processing of personal data (cf. Section 4) within the European Union (EU), and under certain circumstances also applies if the data are processed outside the EU (Art. 3 GDPR).

Under the GDPR, the process of determining whether a person is identifiable is defined as follows:

To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. (Recital 26 GDPR)

Anonymous data are only mentioned as a side topic (in Recital 26), defined as data that do not relate to an individual person.

This discussion shows that the concept of anonymity is not an absolute concept but depends on the entities involved, in particular the controller, the technology and previous data available, and the effort the controller is prepared to invest. Data that may be anonymous for one controller may be personal for another controller. Nevertheless, all legal regulations, including both the GDPR and the US regulations discussed below, assume that there is a binary distinction between personal data/PII that are subject to data protection regulation and anonymous data that are not, with no grey area in between [16].

The main motivation for the paper at hand is to discuss the different approaches to how an organization can achieve and evaluate the degree of anonymity of its data where needed.

2.2.2. The US Family Educational Rights and Privacy Act

The US Family Educational Rights and Privacy Act of 1974 (FERPA) (available from https://www.ecfr.gov/current/title-34/subtitle-A/part-99 (accessed 25 May 2026)) serves to protect PII (20 U.S.C. §1232g; 34 CFR §99.3) in educational institutions or authorities that receive funding from the US Department of Education. FERPA distinguishes between less strictly regulated directory information with low protection requirements and more strictly regulated (non-directory) PII that need protection.

Definition 9 (Directory information).

Information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed. (34 CFR §99.3).

Directory information may include name, address, or photo, among others, while non-directory information consists of information that is considered sensitive. FERPA defines these categories by listing the attributes they include. In addition to direct attributes such as name or biometric data, directory information also includes quasi-identifiers such as place of birth and other information that could allow a link to be made (34 CFR §99.3).

Outside of FERPA, these terms are also used to refer to data subjects in general, not only students.

Directory information may be published without the consent of the person concerned provided that they have been informed or have had the opportunity to object to the process beforehand. The publication of non-directory PII requires prior written consent of the person concerned, unless the information has been “de-identified” first. FERPA does not refer to “anonymized” information, using the term “de-identified information” instead.

Definition 10 (De-identified information).

Information where the educational agency or institution or other party has made a reasonable determination that a student’s identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information. (34 CFR §99.31(b)(1)).

As discussed above for the GDPR, the challenge of deciding what is a “reasonable determination” leads to different degrees of “de-identifiedness”, i.e., anonymity.

2.2.3. The US Health Insurance Portability and Accountability Act Privacy Rule

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was created in the US to regulate the processing and disclosure of health and patient data, and is implemented on the basis of the HIPAA Privacy Rule. This considers particularly sensitive health data to be “protected health information” (PHI) (45 CFR §160.103). In terms of data protection laws, HIPAA plays a special role, as the de-identification of data for further processing is carried out either by expert assessment or by the so-called “safe harbor” method; see Section 3.1.2. (45 CFR §164.514(b)(2)). Note that “safe harbor” refers to something different here than in the former data protection agreement between the US and the EU. For the latter, the HIPAA Privacy Rule defines data types that are considered identifying, including for example name, telephone number, and biometric data (45 CFR §164.514(b)(2)(i)(A-R)), and allows the further processing of PHI provided that it no longer contains any attributes that fall under the “safe harbor” category.

2.3. Threats to and Attacks on Anonymity

In order to formalize the concept of anonymity, we first need to analyze the possible threats to anonymity and what attacks can possibly break it.

2.3.1. Threats

On a functional level, there are three main threats to anonymity (see, e.g., [17], p. 31):

• Identity disclosure (re-identification): An attacker is able to identify an individual within a set of anonymous records.
• Membership disclosure: An attacker is able to identify whether a certain individual is contained in a set of anonymous records, even without being able to clearly determine which specific data record belongs to that individual.
• Attribute disclosure: An attacker is able to identify a sensitive attribute of an individual from a set of anonymous records; for example, the attacker may identify that the individual is in a certain age group and that all members of the dataset within that age group have the same disease.

These threats to anonymity all refer to threats to individuals. If the data reveal information about the entire population or if new, general correlations are found, this is generally not considered a breach of anonymity in spite of the risks involved (p. 17 in [18]; p. 22 in [19]).

On a more technical level, there are three threats which may lead to breaking of anonymity on the functional level:

• Singling out: This refers to the possibility of isolating “some or all records which identify an individual in the dataset” ([20], p. 11). Therefore, successful singling out will lead to the identity of an individual being disclosed.
• Linkability: The “ability to link at least two records concerning the same data subject or a group of data subjects (either in the same database or in two different databases)” [20] (p. 11). Successfully linking records may not be sufficient to identify an individual, but can enable membership or attribute disclosure.
• Inference: “The possibility to deduce, with significant probability, the value of an attribute from the values of a set of other attributes” ([20], p. 12). Thus, successful inference will lead to attribute disclosure.

2.3.2. Attack Vectors

The threats mentioned above can be implemented using the following attack vectors. For these attack vectors on anonymity, it is assumed that attackers can only access the anonymization mechanisms and data outputs; a direct attack on the source data in the form of a cryptographic attack is not considered in this context.

Re-Identification Attacks

Re-identification attacks, also known as de-anonymization, aim to remove an individual’s anonymity by taking advantage of linkability. To do this, links between attributes are used, possibly from different sources and possibly including previous knowledge of an attacker. Individually, the data appear to be anonymized, but when combined the anonymization may become invalid. In relation to the threats mentioned above, linkage of attributes in this case leads to disclosure of identity.

Sweeney was able to demonstrate this impressively in 1997 when she linked data from a health insurance company that were believed to be anonymized with data from the electoral register and was able to clearly identify the then-governor of Massachusetts by comparing postcodes, dates of birth, and gender [8]. A later study revealed that this attack enabled the unambiguous identification of 63.3% of US-Americans [7]. This attack vector illustrates the importance of additional information available to an attacker, even if it appears harmless on its own.

Predicate Singling out Attacks

Predicate singling out (PSO) is a re-identification attack in which the attacker expresses a single predicate that isolates a record in the dataset with very high probability, uniquely identifying an individual (though not necessarily the name or a similar identifier) in the dataset [21]. This may allow linking the record to other available data, thereby forming the basis of a re-identification attack. A more detailed examination of predicate singling out is provided in Section 3.4.

Reconstruction Attacks

In reconstruction attacks, an attacker attempts to recover unknown attributes of a data record (attribute disclosure) with only limited access to the original data. The data are reconstructed using aggregated data from this data record, such as the results of statistical queries, which may also have been altered by data or output perturbation. Dinur and Nissim have shown that such reconstruction can be carried out efficiently and with high probability for a large part of the data if perturbation is insufficient [22]. There is an inherent tradeoff between the usability of data and their protection, since successful reconstruction attacks are made easier by low levels of perturbation, allowing for a large number of queries, datasets with many attributes, or a large amount of additional information about individuals in the dataset [23] (p. 651).

A real-world example of a reconstruction attack was demonstrated by a government-affiliated advisory group called JASON for US census data. Aggregated data were interpreted as a set of integer-valued linear equations and related to published results from the previous census in 2010 ([24], pp. 38–41). This resulted in reconstruction of considerable parts of the data, including sensitive attributes such as race.

An overview of various approaches to reconstruction with different parameters can be found in ([9], pp. 66–70).

Tracing Attacks

Tracing, also known as a membership attack because it tries to achieve membership disclosure, occurs when the attacker can determine (trace) whether or not the information of a specific individual is contained in a dataset. This type of attack is particularly relevant for datasets that do not contain a wide variety of data, making them poorly suited for reconstruction attacks (p. 64 in [9]; p. 651 in [23]). Tracing is also relevant for data in contexts where membership disclosure poses a particular risk to the individuals contained therein, such as medical statistics ([25], p. 2). Tracing has gained particular importance in recent years in the field of machine learning, where membership inference attacks aim to determine whether certain data have been used to train a machine learning model [26,27].

2.4. Anonymization Techniques

There are many anonymization techniques that aim to prevent the attacks described. Most of these techniques can be grouped into randomization techniques and generalization techniques.

Randomization techniques aim to break the link between individuals and their data. Each record still refers to a unique individual, but randomization can reduce the risks of singling out as well as of inferences being drawn about individuals ([20], p. 12), allowing only statistical inferences about the entire dataset. Suitable techniques include adding noise (random values of known statistical distribution), permutation of values between different records within the dataset, synthetic data generated based on relevant statistical properties of the original dataset, and suppression or deletion of attributes.

Generalization techniques work by replacing specific values with more general values; for example, “orthopaedic surgeon” could become “medical professional”, or “age 27” could become “age group 20–30”. Generalization also includes techniques such as rounding, suppression, and aggregation of data. The main aim is to protect data against singling out; generalization does not protect against linkability and inference, since the fundamental relationship between individuals (records) and attributes remains intact ([20], p. 16). Therefore, it is still possible to link data from different sources with a high degree of certainty, which allows conclusions to be drawn about other attributes associated with an individual (risk of inference).

Another technique is suppression, which may be considered as an extreme case of generalization but is usually considered separately. In this case, data fields are suppressed and no value is stated at all, usually marked by the dummy value ∗.

2.5. Models of Anonymity and Their Properties

The anonymization techniques discussed above take personal data and turn them into anonymous data. In Section 3, we introduce different formal models for describing the degree of anonymity that can be achieved and how easy or difficult it is to break this anonymity. To evaluate these models of anonymity, we introduce their relevant properties, namely, generality, composability, robustness to postprocessing, and avoidance of distributional assumptions.

Definition 11 (Generality).

The generality of a model describes the property that the model can be used to evaluate the anonymity of different types of data (structured, textual, and numeric) independent of regulatory requirements on anonymity.

Remember that as stated above, the analysis in this paper is restricted to structured, textual, and numeric data; we do not investigate applicability to other data types such as image, video, and audio.

The focus of this paper is on evaluating the achieved degree of anonymity. A closely related question when developing software concerns the availability of algorithms to achieve the required degree of anonymity.

Definition 12 (Availability of algorithms).

An anonymity model is considered to have high availability of algorithms if algorithms have been published that support the implementation of anonymity according to the model and that in total address a large number of application scenarios.

Note that according to this definition, we are not concerned about the number of algorithms that are available but about the application scenarios addressed by these algorithms.

Core properties of anonymity models concern different aspects of their security against de-anonymization. If personal data are processed repeatedly in such a way that the results are anonymous, it may nevertheless be possible to break the anonymity of these results by composing the results. To some extent, any use of personal data and release of the results leads to a loss of privacy. A simple example involves calculating the average age of a group of people and publication of the result. While this alone may lead to only a very small loss of privacy (in particular if the group of people is large), the combination of these small losses may lead to an unexpected and serious loss of privacy. For example, this happened with published statistical data from the 2010 US Census, where a database reconstruction attack made it possible to reconstruct the original data for 46% of the US population ([28], p. 286). Therefore, an important property of anonymization techniques (indeed of approaches to privacy preservation more generally) is composability.

Definition 13 (Composition effects; composability).

Composition effects are the cumulative results on privacy of repeatedly using data.

An approach to preserving privacy is composable if it “can be shown to limit privacy loss in a manner that degrades predictably and gradually across repeated applications” ([28], p. 287).

A formal model of anonymity is composable if the composition of repeatedly processing a set of data is guaranteed to be anonymous when the results of each processing are anonymous according to the model. Implicitly, this also requires algorithms to achieve different levels of anonymity where this is supported by the model.

Similarly, Cohen and Nissim describe composability as the property that the data protection risk of multiple data publications should not be significantly greater than the accumulated risks of the individual publications ([21], p. 8346).

A second relevant property of anonymization techniques addresses the fact that one can assume that its output will be further processed. Therefore, anonymization techniques should be designed in such a way that their outputs do not suffer any deterioration in data protection as a result of any postprocessing. This property is referred to as robustness against postprocessing.

Definition 14 (Robustness (immunity) against postprocessing).

A technique is robust (immune) against postprocessing if anything that can be computed using the output of a technique can be considered secure, provided that the technique itself is considered secure. (p. 18f in [19]; p. 8346 in [21]).

The fact that this property must actually be inherent in the mechanism and not in the output is demonstrated by the potential for attacks on data outputs. Kenthapadi et al. were able to show that not only can outputs reveal information, the refusal of outputs by auditing procedures can do so as well [29].

Some anonymization mechanisms work only when certain assumptions about the statistical distribution of the data apply (p. 741 in [30]; p. 1476 in [31]). These assumptions may or may not correspond to the statistical distribution in the real data, possibly reducing the protective effect of the anonymization technique. For example, a technique may assume that values are evenly distributed in the dataset when in actual fact the data contain clusters of values.

Definition 15 (Avoiding reliance on distributional assumptions).

An anonymization technique avoids reliance on statistical assumptions if its effectiveness is independent of the statistical distribution of the anonymized data.

3. Formal Models of Anonymity

The models examined here include logical modelling of legal templates, modelling applied anonymity, modelling concepts of the GDPR, and mathematical formalization of legal templates.

3.1. k-Anonymity and Related Models

k-Anonymity and related models are based on the concept of quasi-identifiers, introduced in Definition 8, and quantifies the extent to which individuals can be uniquely identified using quasi-identifiers. Since k-anonymity turns out to be insufficient to protect privacy, several extensions have been introduced; these are summarized below.

3.1.1. Basic Concept

k-Anonymity [14,32] is a property of datasets that quantifies anonymity by the minimum number k of records that are indistinguishable within the dataset based on the quasi-identifiers. For this purpose, the attributes of data records are split into four groups. First, identifiers are removed in order to achieve anonymity. Sensitive attributes contain information that needs to be kept confidential. Quasi-identifiers are a subset of the non-sensitive attributes, and can possibly be used to identify individuals from the dataset.

Definition 16 (k-Anonymity).

A table is called k-anonymous (for some value $k\in \mathbb{N}$) if any combination of values of the quasi-identifiers in the table occurs at least k times (or not at all) ([33], p. 151).

For example, given a dataset with the QI consisting of the attributes “age” and “postcode”, the dataset is said to be k-anonymous if for any combination of values of this QI there are at least k records with the same values for age and postcode. The main technique used to achieve k-anonymity is generalization. An anonymization technique is called k-anonymous if, given a table of data records and a set of QIs used, it will adapt the data in such a way that they become k-anonymous.

k-anonymity is a well-known model of anonymity, since it is very intuitive and easy to understand and implement. It provides protection against the re-identification of data, but little protection against membership and attribute disclosure. Especially with small values of k, it may be possible to derive sensitive attributes if all members of the equivalence class have the same or at least similar values for this attribute (homogeneity attack). To address these limitations of k-anonymity and improve the degree of anonymity achieved, the concepts of ℓ-diversity [34] and t-closeness [35] have been introduced; however, these are far more complex to understand and implement.

3.1.2. The HIPAA Safe Harbor Model

The HIPAA Safe Harbor model [36] uses an approach to anonymization that can be seen as a simplified variant of k-anonymity. In contrast to other anonymization techniques, this model explicitly lists specific attributes of health data. As such, it cannot directly be applied to other domains (see [33], p. 148f for more discussion about how to adapt this model to other domains.) Apart from the obvious requirement to delete any attributes that can act as identifiers (social security numbers, email addresses, telephone numbers), two types of attributes are required to be be generalized: geographic subdivisions such as ZIP codes need to be modified in such a way that they refer to at least 20,000 individuals, e.g., by leaving out some characters of the ZIP code; similarly, dates such as birth dates must be generalized to only contain the year, with ages over 89 aggregated into a single “90 years or older” category. The goal of these rules is similar to k-anonymity, namely, to ensure that there always is a large number of individuals in a set of anonymized data that cannot be distinguished. However, it does not actually guarantee k-anonymity, since the combination of multiple attributes may be sufficient to uniquely identify an individual.

3.1.3. Analysis

The model of k-anonymity and its derivatives are widely applicable to different types of data. However, a fundamental problem of this approach is that it is based on the concept of quasi-identifiers; put differently, it assumes that some attributes in a table are certain to be unsuitable for identification. It is doubtful the extent to which this assumption is true for any set of data that is of practical interest, resulting in limited generality of the model.

Many algorithms that implement k-anonymity are based mainly on generalization. For example, the ARX toolbox [37] implements several such algorithms.

Furthermore, k-anonymity and its derivatives do not satisfy the important properties introduced in Section 2.5 above. They are not composable, meaning that for two sets of data ($k_1$-anonymous and $k_2$-anonymous) that are both derived from the same original set of personal data, the k-anonymity of the composition of these datasets is not predictable (p. 290 in [28]; p. 12 in [31]). Similarly, they are not robust against postprocessing, and rely on distributional assumptions ([31], p. 12).

As a result, in spite of their popularity, k-anonymity models and their derivatives are insufficient for protecting genuinely sensitive data, and are only adequate if the damage resulting from a breach of anonymity is low. If used at all, these models should incorporate a fairly large value of k.

3.2. Differential Privacy

3.2.1. Basic Concept

Differential privacy (DP), first introduced by Dwork et al. [38], models anonymity as a property of data analysis algorithms rather than of a set of data. The basic idea is that a data analysis mechanism is considered differentially private if the information gained about any specific individuals by including them in a calculation is only marginally greater than if they had not been included (p. 715 in [30]; p. 212 in [39]). This makes it more difficult for attackers to derive information about an individual from the data. The information gain is quantified using a privacy (loss) parameter denoted by the letter epsilon, $ϵ$ ([39], p. 212); for this reason, it is also called $ϵ$-differential privacy. The relaxation ($ϵ$,$\delta$)-differential privacy proposed by Dwork and Roth in ([19], pp. 17–18) is not considered in this paper.

Formally, this results in the following definition for $ϵ$-differential privacy. Let there be an anonymizing mechanism M with range R of output values. Let there also be two datasets D and $D^{\prime }$ which differ only in one entry, namely, that of one individual involved, and as such are referred to as adjacent. To understand the principle, it can be assumed that the dataset without the entry of the individual under consideration is D, while $D^{\prime }$ is the dataset including the entry; a reverse view would also be permissible. The part of the output of M that is available to an attacker, for example because it is the publicly available result of the data analysis, is denoted as a set S, where $S\subseteq R$. Whether a mechanism satisfies differential privacy is indicated by comparing the probabilities $Pr$. Differential privacy is satisfied if the probability of the output of M based on the input D is less than or equal to the probability of the output of M based on the input $D^{\prime }$ times $e^{ϵ}$.

This means that the probability of a result containing the data of the individual in question is at most $e^{ϵ}$ as large as the probability that it is the result without the data of the individual in question. For sufficiently small $ϵ$, we have $e^{ϵ}\approx ϵ$ ([39], p. 241). Thus, the factor $e^{ϵ}$ determines the anonymity protection of any individual’s data. It follows that larger $ϵ$ indicates more relaxed anonymity.

Definition 17 (Differential privacy).

A mechanism M satisfies ϵ-differential privacy for $ϵ\ge 0$ if, for every adjacent pair of datasets D and $D^{\prime }$, for every subset $S\subseteq R$, and for $Pr[\dots ]$ denoting the probability of an event, we have

$$Pr[M\left(D\right)\in S]\le e^{ϵ}·Pr[M\left(D^{\prime }\right)\in S]$$

As a result, a smaller value of $ϵ$ is synonymous with more data protection and less accuracy. According to ([19], p. 25), $ϵ$ should be “moderately small”, while Wood et al. recommend a value $ϵ<1$ ([39], p. 236f). If a dataset is accessed repeatedly using differentially private mechanisms, the total loss of privacy can be quantified by the sum of the $ϵ$-values of these mechanisms (p. 19 in [19]; Theorem 3.5 in [40]).

Differential privacy is often achieved by adding random noise ([39], p. 232). In this case, the $ϵ$ parameter determines the degree of noise that is required, and consequently the desired level of data protection. A very simple and easy to understand variant is the use of randomized response, which is a well-known technique for querying sensitive data based on yes–no answers where the respondents may be hesitant to answer correctly. The technique is designed to provide sufficient anonymity at the individual level while simultaneously providing usable information for researchers. The mechanism as described by ([19], pp. 29–30) begins with a yes–no question about property P, followed by:

• Flipping a coin secretly;
• If it is tails, answering truthfully;
• If it is heads, flipping the coin again in secret, then answering “yes” for heads and “no” for tails.

The noise is the result of the random probability distribution of the coin tosses and respective answers. This provides protection at the individual level, since the mechanism supports plausible deniability for each individual ([19], p. 15). The probability of a positive response, independent of the true answer, is at least $1/4$. For larger datasets, the noise follows a probability distribution that can be removed from the evaluation of the entire dataset. This enables statistical analysis of the answers while keeping each individual’s correct answer differentially private with a privacy loss of $ϵ=ln3\approx 1.1$ ([19], p. 30). However, if the same question is asked repeatedly to the same person, the true answer becomes obvious, since the true answer is given with a probability of 75% and the false answer with a probability of 25%. This is modelled by the fact that the privacy losses $ϵ$ add up with each repetition.

3.2.2. Global vs. Local Differential Privacy

A limitation of DP as described above is that the data analysis mechanism is run by a central processor or curator that needs access to all the data [4]. In a scenario where the data subjects do not fully trust the central processor, this is not sufficient. This is addressed by the concept of local DP, introduced by [41], where noise is added at the individual level before the data are transferred to the central processor. (In fact, the example of randomized response discussed above already uses local DP). The noisy data are then added to the data collection. In global implementation, the data are added to the data collection in the original state, then noise is added after the data have been analysed. While local models increase privacy, this comes at a cost: the total noise needed is considerably higher compared to the global model, leading to lower accuracy of the overall results of data analysis. An application example of the use of local DP for federated machine learning can be found in [42].

3.2.3. Analysis

Differential privacy is often considered a promising solution, and several companies (including e.g., Apple and Google) as well as the U.S. Census Bureau have reported that they use DP in their work. Its main limitation is the need for a trusted curator, which conflicts with the legal concept of anonymity that does not consider the processor as a trustworthy entity ([4], p. 194). There is a way out of this conflict by using local DP; however, this leads to a serious loss of accuracy which, depending on the task at hand, may or may not be acceptable. As a result, it is of limited generality; nonetheless, there are suitable algorithms for many different scenarios [19].

Differential privacy meets the requirements placed on anonymization techniques by scientific and legal authorities due to its mathematical definition, including the properties described in Section 2.5. it is composable ([19], pp. 41–43), which means that it is possible to calculate the total loss of anonymity caused by multiple data publications. To do this, the $ϵ$ values for each run of the mechanism can be summed, allowing the total loss of anonymity to be calculated for an individual. Differential privacy also satisfies robustness against postprocessing ([19], pp. 18–19) which means the output of a mechanism that fulfills DP cannot experience any change in anonymity through further processing of an output so long as no additional information is available. The specified value for $ϵ$ remains unchanged even with further processing. Finally, DP makes no assumptions about potential attackers and attack forms, protecting against a large number of attacks (p. 194 in [4]; p. 271 in [39]), including previously unknown ones (p. 714 in [30]; p. 235 in [39]). Satisfying these properties is important for the assurances that DP can make, primarily that the loss of anonymity remains quantifiable after multiple and sequential processing.

In practical terms, DP allows for quantitative specification of the degree of anonymity required for any specific use case, rather than just distinguishing between anonymous data and personal data, as is done in current legal data protection regulations. This makes it possible to define a so-called privacy budget $ϵ$ ([39], pp. 251–253) which is then gradually spent by successive data analyses and the publication of the results. To date, such privacy budgets have not been defined in any legal regulations, although a report by the US standardization body NIST provides guidelines for setting privacy budgets [43].

The application of DP is subject to certain restrictions. Even if a calculation is differentially private, an attacker may still be able to learn something about individuals from the output data, including those whose data are not contained in the affected dataset. If the output data set includes information about certain groups (e.g., smokers) and the attacker has the additional knowledge that a certain individual belongs to this group (is a smoker), they can draw conclusions about the attributes of the individuals concerned. The attacker can make these statements regardless of whether individual data are included ([19], p. 22).

Furthermore, the addition of noise causes the outputs of differentially private algorithms to scatter around the original value. This means that the usability of these data may be limited. A balance must be struck between data protection and usability or accuracy. This scattering may even lead to inconsistent individual values, such as a negative age, which explains why DP is particularly suitable for aggregated data ([39], p. 219). While individual values can deviate significantly from the original value, this is no longer the case with large volumes of data. It should be noted that due to the randomness of the added noise, two identical queries to the same database are likely to produce different outputs.

However, even local implementation does not necessarily comply with the legal text, as it does not refer to the ownership of the device on which the processing takes place but to the controller (Art. 5 (2) GDPR), who “decides on the purposes and means of processing” (Art. 4 (7) GDPR) ([4], p. 195). Second, according to Hölzel, the underlying premises of anonymization mechanisms and differential privacy are not congruent. While the former approach serves to protect against the disclosure of identity, differential privacy aims to reduce the likelihood of harm to an individual through their presence in the data. According to Hölzel, these approaches cannot be easily compared. Furthermore, Hölzel warns that the differential privacy approach initially only provides protection against correct identification, not necessarily against false positive identifications. However, according to Hölzel, the GDPR does not make an explicit distinction between correct and false positive identification; thus, correct identification is not a prerequisite for the applicability of the GDPR.

3.3. Game-Theoretic Modelling

3.3.1. Basic Concept

Game theory is a mathematical concept commonly used to model threats and attacks in cryptography. Similarly, this can be used to both model attacks on anonymity and to describe anonymity for protecting against such attacks. Wan et al. used this concept to analyze the risk of re-identification of anonymized data [44]. This section also refers to the work of Nissim et al. [30], who used game theory to model anonymity and privacy protection according to FERPA (cf. Section 2.2), as well as the more general approach of Prasser et al. [45].

3.3.2. The FERPA Data Protection Game

In their analysis, Nissim et al. used game-theoretic modelling (GTM) to define anonymity; following the principle of process protection in ([18], p. 13), and similar to DP, they described anonymity as a property of a given computation, for example statistical analysis of a set of PII, rather than a property of the data. The goal is to protect the computation against attacks attempting to achieve identity disclosure, membership disclosure, or attribute disclosure. A computation accepts an input and generates an output from it, where the attacker is assumed to be familiar with the computation. This assumption is based on Kerckhoffs’ principle, according to which the confidentiality of information must not depend on the confidentiality of the encryption mechanism. The same idea was also defined as the transparency principle for defining anonymization in ([18], p. 40)

FERPA distinguishes between directory (freely accessible) and non-directory (confidential) information and defines requirements on computations that process these data. In particular, FERPA puts a focus on protection against different forms of attacks in which an attacker tries to break anonymity by using the output of such computations in order to identify non-directory data with a higher probability than would be possible without the use of that output.

The interaction between the attacker and the computation is described as a game called the FERPA privacy game. This game follows defined rules by which the attacker tries to gain additional information about the individuals. An attack is considered successful if the attacker correctly guesses an attribute of an individual. The computation is considered FERPA-compliant if the probability of the attacker winning the game is not significantly increased by any such interaction. Of course, there is a certain probability that the attacker will correctly guess the attribute, for example the gender of the individual, even without access to the output of the computation. Similar to differential privacy, the probability is quantified by a privacy loss parameter $ϵ$, where the probability of the attacker winning the game may grow by at most a factor of $(1+ϵ)$.

Nissim et al. considered three different types of attacks on FERPA compliance. The first of these, which is narrowly defined and on which the others are based, is examined in detail here. It deals with a targeted attack in which the attacker commits to a specific target before seeing the output data. The attacker then uses the output data to make assumptions about the target’s private information ([30], p. 753f). However, the attacker can only rely on one computation ([30], p. 761). The attacker selects a source containing information about individuals and assigns a probability distribution to each individual that corresponds with the attacker’s a priori assumptions about the respective non-directory PII, then selects a function f. The scope of action of f is private information, f being representative of the information aspect that the attacker wants to explore ([30], p. 754f). The attacker then passes the source, probability distributions, and f to the game mechanics. For this form of attack, the attacker must also name their target at this point. The game mechanics instantiate a database by random selection from these inputs, using the provided probability distributions. A computation C receives this database and the directory information, not knowing the target’s identity or the provided function, then generates an output statistic. Based on this output, the attacker guesses an attribute of the selected target’s non-directory PII. If this guess corresponds to the result of the function f on the non-directory PII of the target, the attacker wins the game. A computation is called privacy-preserving if the probability of success is approximately the same, i.e., limited by the factor $(1+ϵ)$, as that of an attacker who does not have access to the output data.

Nissim et al. described two extensions of this attack model: the first considers untargeted attacks, and the second the effects of multiple data publications ([30], p. 761f). In an untargeted attack, the attacker does not select their target before the calculation, only after viewing the output data. When multiple datasets are published, even if all publications are privacy-preserving on their own (composability), there is still a risk that the entirety of the publications will be vulnerable in terms of data protection.

GTM is then used to show that it is possible to defeat these attacks by applying differential privacy, and thus to comply with the respective FERPA requirements. The complete proof can be found in ([3], Appendix II, pp. 772–776).

3.3.3. The ARX Game-Theoretic Model

In [45], based on previous work by Wan et al. [44], Prasser et al. described a different game-theoretic approach to modelling de-identification, with a focus on health data. This model assumes two players: a publisher who wants to publish data, e.g., for medical research, and an attacker who wants to de-identify the published data. The main parameters of the game are estimated values for (a) the attacker’s gain for one successfully de-identified record, (b) the attacker’s cost for each attack on one record, (c) the publisher’s benefit for publishing one original record, (d) the publisher’s loss due to one successfully de-identified record, (e) the attacker’s success probability when attacking a record r, and (f) the information loss due to anonymization of one record r. Based on these estimates, both players try to maximize their profit by playing the game.

The publisher plays the game by deciding on the levels of generalization and suppression to be used for the different data fields. For this purpose, Prasser et al. described a generalization hierarchy in which age 42 may be generalized either to the 40–60 age group, or one level higher to the 20–80 age group, and eventually to ∗ ([45], p. 1432). When using k-anonymity, this allows the publisher to, for instance, calculate that a value of k must be selected such that $k>{\mathit{attacker}}^{\prime }\mathit{s}\mathit{gain}/{\mathit{attacker}}^{\prime }\mathit{s}\mathit{cost}$ in order to prevent attacks ([45], p. 1435). Of course, this model assumes that the estimated values for gain, cost, etc., are realistic, as well as that attackers will behave rationally and only attack if their expected gain is higher than the expected cost.

Anonymization according to this model is also supported by the ARX toolbox, which helps in finding the publisher’s optimal strategy (consisting of generalization and suppression of data). In addition to domain-level generalization, ARX also supports record-level generalization, which means that different levels in the generalization hierarchy may be used for different records.

3.3.4. Analysis

Game-theoretic modelling does not model anonymity as such, instead providing a technique for analysing possible attacks on anonymity and measures that can protect against these attacks. The FERPA-based approach is a very specific approach to modelling the specific requirements of FERPA; in comparison, the ARX approach is somewhat more general but requires quantitative estimates of several relevant parameters. Another game theory-based approach for use in machine learning contexts was introduced by [46]. While there are no algorithms for modelling attacks as such, there may be applicable algorithms depending on the type of model selected, as in the ARX model.

As mentioned, the game-theoretical model of anonymity presented by Nissim et al. is only intended for modelling FERPA, not as a general concept for modelling anonymity. While extension to a general methodology was originally planned ([30], p. 769), the authors eventually continued their work with an analysis of predicate singling out (discussed in Section 3.4 below) instead; see [21], p. 8345.

Regarding the security properties of anonymity models, the composition property holds as discussed in the second extension of the attack model above. Robustness against postprocessing was not explicitly addressed by Nissim et al., although it was hinted at multiple times ([30], pp. 744, 772). Finally, GTM does not rely on any distributional assumptions, instead taking the distribution as an input and setting a limit on the extent of change to the distribution resulting from the game.

Similar to k-anonymity and differential privacy, this model distinguishes different levels of anonymity as quantified by a parameter $ϵ$, which plays a similar role but is not identical with the $ϵ$ parameter in differential privacy.

3.4. Predicate Singling out

Singling out, also called isolation, is mentioned in Recital 26 GDPR as an example technique for breaking anonymity (cf. Section 2.2.1), but without explanation of what exactly is meant by this technique. In order to formalize this legal concept, Cohen and Nissim in [21] introduced predicate singling out (PSO), later expanded in [47], where an individual is singled out from a dataset using a predicate that is only true for this individual, even if it may not be possible to name the individual in question ([20], p. 14). If PSO is possible, this may enable re-identification attacks by linking the singled-out record to other available data.

3.4.1. The Basic Concept

Definition 18 (Predicate singling out (PSO)).

Given a dataset $\mathbf{x}=\{x_1,\dots ,x_n\}$ of size n, where each entry $x_i\in {\{0,1\}}^d$ contains the personal data of one individual represented using d bit:

A predicate is a function $p:\mathbf{x}\to \mathrm{Bool}$;

A predicate p singles out (isolates) an entry from $\mathbf{x}$ if there is there is exactly one $x_i\in \mathbf{x}$ such that $p\left(x_i\right)=\mathrm{true}$.

Assume that we want to publish anonymized information $\mathbf{y}=\mathcal{M}\left(\mathbf{x}\right)$ about $\mathbf{x}$ based on some anonymization mechanism $\mathcal{M}$. However, we want to prevent an attacker from using $\mathbf{y}$ to define a predicate that singles out an individual from $\mathbf{x}$. As shown in ([21], p. 8346), even a trivial attacker without access to $\mathbf{y}$ may still achieve a high probability of defining such a predicate. For example, consider a case where $\mathbf{x}$ contains n entries, each including an attribute (e.g., the birthday) with n different possible values with equal probability. Now, select an arbitrary value a of the attribute (e.g., 15 March) and define the predicate stating that the attribute has this arbitrary value. Then, the probability of isolating an entry by this predicate is about 37% ([21], p. 8348). Therefore, protection against singling out must be defined in terms of the improvement over the baseline of not using the output $\mathbf{y}$, rather than in absolute terms.

Definition 19 (PSO security).

A anonymization mechanism $\mathcal{M}$ is PSO-secure if no attacker can use its output $\mathbf{y}=\mathcal{M}\left(\mathbf{x}\right)$ to define a predicate p for singling out a record with significantly higher probability than possible without access to $\mathbf{y}$.

Similar to other models such as differential privacy, the degree of anonymity is quantified by privacy parameters $ϵ\left(n\right)$ and $\delta \left(n\right)$, which in this case depend on the size n of the dataset.

Security against singling out is a necessary condition for anonymity according to the GDPR, which explicitly states that this condition is not sufficient and consequently not a full formalization of anonymity ([21], p. 8349). Although isolation alone is not a serious privacy problem in general, a successful isolation attack can be the first step towards a larger data breach ([47], p. 9), and can serve as the basis for discrimination against an individual even if no clear identity can be assigned to them ([47], p. 30).

3.4.2. Analysis

The PSO model is widely applicable to different application scenarios, and as such is quite general. However, in contrast to the previous models, PSO security does not attempt to define and quantify anonymity but only addresses an important requirement for anonymity, expressing that the result of an anonymization mechanism is secure against a highly relevant type of attack.

In a comparison between PSO and other models, it has been shown that if a mechanism satisfies DP, then it is PSO-secure ([21], p. 43). However, these two properties are not equivalent, since PSO security does not imply differential privacy. While this implies that all DP algorithms also lead to PSO security, there are hardly any algorithms that specifically support PSO security. k-Anonymity (as well as its ℓ-diversity and t-closeness variants) do not guarantee PSO security, confirming that k-anonymity is a rather weak form of anonymity. The analysis in ([21], pp. 38–41) shows that the contrary claim by the EU supervisory authorities in ([20], p. 16), stating that k-anonymity protects against singling out, is not actually correct.

Unlike differential privacy, PSO does not consider individuals or the specific data protection risks arising from their inclusion in a dataset. Instead, PSO focuses on the isolation of individuals without the need for any actual personal reference. This means that there is no direct data protection risk, only an indirect and possibly nonspecific one.

Regarding the security properties of anonymization, it can be shown that PSO is not composable ([21], pp. 8349–8350), but is robust against postprocessing ([21], p. 8349). Thus, if the output of a PSO-secure mechanism is used as an input for subsequent processing, the result of this processing is also PSO-secure. Finally, PSO makes assumptions about distributions, since its analysis requires that the data be independent and identically distributed ([21], p. 8349), which is not necessarily a realistic representation of data distributions (p. 8349 in [21]; pp. 25–26 in [47]). Nevertheless, a mechanism should be able to satisfy this restricted form of PSO in order to provide protection against isolation in general. This restriction of the model means that the model can be used to falsify PSO security, but not to guarantee anonymity.

4. Cross-Model Analysis

In this chapter, we compare the different models, then analyse their limitations and implementation in software.

4.1. Comparison of the Different Models

Table 1. Model approaches and limitations.

Model	Approach	Limitations
k-anonymity, ℓ-diversity, t-closeness	ensuring that individuals cannot be distinguished based on QI	poor protection against membership and attribute disclosure
differential privacy	quantifying knowledge gain due to inclusion of an individual	global DP: need for trustworthy curator
		local DP: reduced accuracy of results
game-theoretic models	modelling of attacks on anonymity and protection against them	separate model needed for each anonymization mechanism or context
predicate singling out	modelling of one specific privacy property	no guarantee for anonymity in general

provides an overview of the main characteristics of the modelling techniques as described in Section 3.

In Section 3, the criteria are applied to the formal models; the results of these evaluations are then summarized in

Table 2. Model properties.

Model	Generality	Availability of Algorithms	Composability	Robustness Against Postprocessing	No Reliance on Distributional Assumptions
k-anonymity, ℓ-diversity, t-closeness	limited	high	no	no	no
differential privacy	limited	high	yes	yes	yes
game-theoretic models	medium	low	yes	yes	yes
predicate singling out	high	low	no	yes	no

.

k-anonymity was the first formal model of anonymity, and remains the one that is easiest to understand. However, later research has shown that it describes a fairly weak form of anonymity, does not satisfy the important properties of composability and robustness against postprocessing, and relies on assumptions about the distribution of the data under consideration. Today, it can mainly be considered adequate for data with low requirements on anonymity, where breaking of anonymity does not cause serious damage.

Differential privacy aims to model a universally valid and all-encompassing interpretation of anonymity, and is often described as the “gold standard” of anonymization. Its core idea is to limit the knowledge gained by including additional individuals when processing data. It satisfies all three anonymization properties, and can also be incorporated into GTM and PSO to guarantee sufficient protection against attacks; however, due to its need for a trusted curator, in many contexts global differential privacy does not support anonymity in the sense of legal regulations such as the GDPR. This means that local differential privacy must be used in many cases, which comes at a considerable cost regarding data accuracy.

The main practical challenge of DP is that it is difficult to implement, although many algorithms have been published for this purpose, in particular in [19]. Another challenge is that it is difficult to strike a balance between a sufficient level of privacy and maintaining the utility of the data. This actually applies to all models of anonymity and is not specific to differential privacy, but becomes very visible when trying to select an adequate value of $ϵ$.

GTM and PSO both focus on modelling attacks on anonymity and on how well a mechanism protects against these. Both are useful for better understanding the concept of anonymity, but are not sufficiently general as models of anonymity. GTM needs a separate model for each legal or regulatory framework, and the resulting degree of anonymity depends on this framework; as a result, the anonymity achieved in the context of different regulatory frameworks, e.g., GDPR and FERPA, is not comparable. Therefore, it is primarily suitable for analysing requirements and verifying whether a given mechanism meets basic anonymity requirements. In addition, the model allows for a differentiated consideration of parameters that can influence anonymity, such as the attacker’s prior knowledge. On the other hand, PSO covers only part of the general concept of anonymity, and as such is explicitly described as a necessary but not sufficient condition on anonymity.

4.2. Limitations of Modelling Anonymity

Anonymity should not be understood as an absolute binary value. The models presented above, most obviously k-anonymity and $ϵ$-differential privacy, consider this issue and allow users to parameterize the model in order to quantify the required degree of anonymity. In this context, it should be kept in mind that anonymity represents a declining quantity with irreversible loss. Additionally, identification of membership in a dataset can pose a risk even on its own, for instance participation in a medical study.

Unfortunately, this contrasts with the legal or normative view of anonymity, which considers anonymity to be a binary property that either applies or does not apply.

This disparity creates a problem in modelling anonymity that is further exacerbated by differences in language and precision. Formal modelling requires accuracy in definitions, theorems, and proofs, but legislation needs a certain amount of leeway in order to accommodate future developments and make regulations and laws future-proof. This results in uncertainty about whether a certain model correctly describes the legal interpretation. Put differently, formal modelling makes ambiguities and gaps in the legal text visible. This results in a discrepancy between the template and the model, meaning that any implementation based on a model only fulfills the requirements of the model, not necessarily the requirements of the legal basis.

These limitations are one of the reasons why there are currently several different models of anonymity which address different limitations. To model anonymity, the first step should be to clarify the context so that one can select the most suitable model for the use case under consideration and then use it to separate between anonymous and personal data.

An aspect of anonymity that is not addressed in this paper is group anonymity, since it is not usually included in definitions of anonymity, and in particular the relevant legal regulations. However, group anonymity remains a relevant topic for analysis and further research, as groups may also need sound protection due to the vulnerability of their anonymity.

4.3. Some Comments on Implementing Anonymization in Software

The first step for implementing anonymization in software is to clarify the usage scenario and the resulting legal and functional requirements, which can then form the basis for selecting an appropriate model of anonymity, as well as the appropriate privacy parameter where applicable. For example, global differential privacy can be a very useful model in contexts where a central curator with access to the data is acceptable. If this is not the case (for example because genuine anonymity according to the GDPR is required), then global DP is not sufficient; however, local DP may be. Therefore, it is important during this requirements analysis step to identify who is considered an attacker as well as what previous knowledge attackers are assumed to have available for use in attacking anonymity. For example, attackers may be assumed to know that a certain individual is or is not contained in the dataset under consideration; alternatively, they may be assumed to know certain attributes of an individual that may be used for an attack based on linkability.

When this has been done, the task is then to implement it into the software systems under consideration. Many algorithms have been published for this purpose; similar to cryptography, it is strongly recommended to use published and thoroughly analysed implementations of these algorithms rather than trying to implement them independently, as this runs the risk of overlooking apparently minor details that could break anonymity. For suitable open-source tools, see for example the collection of statistical disclosure control (SDC) tools in official statistics (https://cros.ec.europa.eu/sdc-tools (accessed 25 May 2026)) as well as the ARX tool set [37] specifically designed for de-identifying biomedical data (https://arx.deidentifier.org/ (accessed 25 May 2026)). Since such collections of algorithms or tools also come with support for parameterization, their use also enables the setting of privacy parameters as required. Furthermore, since the verification of anonymity is a complex task, it can be helpful to use tools that have already been verified by the provider, at least in an informal way.

Whichever anonymity model and anonymization technique is selected, it is important to consider that until anonymization is completed, the data concerned are personal data that need to be handled accordingly. This raises the question of which device is used for processing the data, e.g., are the data anonymized before or after leaving the user’s device? In the case of differential privacy, this marks the difference between local and global differential privacy.

5. Conclusions

Complete anonymization while still allowing the data to be usable is not possible from a technical point of view. Anonymity is always a relative value that must be seen as a risk assessment.

However, formal modelling of anonymity helps to understand and implement the concept in software systems, helping organizations to comply with data protection regulations such as the GDPR. As our review of different models shows, the legal definitions of anonymity leave room for interpretation, and the extent to which a formal model overlaps with a legal definition of anonymity is not always clear. Nevertheless, formalization can at least help to identify ambiguities and enable developers to make better design decisions for the anonymization of personal data. Last not least, the use of a formal model also provides strong arguments in court if there is doubt about whether data were adequately anonymized, though for a weak model such as k-anonymity this is true only to a very limited extent.