Aligning Legal Definitions of Personal Information with the Computer Science of Identifiability

The computer science literature on identification of people using personal information paints a wide spectrum, from aggregate that doesn’t contain about individual people, to itself identifies person. However, privacy laws and regulations often distinguish between only two types, called personally identifiable de-identified information. We show the collapse this technological spectrum identifiability into legal definitions results in failure encourage privacy-preserving practices. propose set spans spectrum. We start with anonymous Computer has created anonymization algorithms, including differential privacy, provide mathematical guarantees person cannot be identified. Although California Consumer Privacy Act (CCPA) defines information, it treats same as definition based possibility logical association other argue for exclusion notice consent requirements. We next consider de-identification generalization, minimize (but not eliminate) risk re-identification. GDPR but CCPA do align. reasonableness controls protect against inclusion requirements, choice address distinction trackable non-trackable shown how one-time identifiers can used reasonably linkable being tracked over time. both discuss profiling, neither formally form thus fail adequately it. likelihood contexts. tracking. requiring stronger forms user which will use information. Finally, we pseudonymous pseudonyms reduce identification. Neither nor makes reasonable information. Our replace over-simplified versus hope full comprehensive law tailor requirements characteristics each type