Hacker News Reader

> These snapshots are updated daily through a pipeline that involves taking an LVM snapshot of production data, anonymizing the dataset by stripping all personal data, and transferring it via rsync to the development database servers.

I don’t know what sort of data these people process, but most datasets about people are not anonymized by simply removing the PII.

View on HN

Yes they are. Any information that can be used to identify a person by definition is PII.

Once all the PII is removed, by definition the dataset is anonymized.

This is obviously true, as you are stating an axiom. But what I think the grand parent is trying to say is that databases with PII can often be deanonymized by looking at the other data that isn't obviously PII.

Take for example a database over all mobile phone positions over time, this can be 'anonymized' by removing all connections from the phones to information on who owns the phones.

But it can still be trivially deanonymized by analyzing where the phones are at night and during office hours, not very many persons work in the same building and sleep in the same house.

Reply on news.ycombinator.com