Hi Gino,
As someone with a privacy certification, I also struggled to understand the
definition of anonymizing and pseudonymizing until a privacy lawyer took the time to explain it to me:
- Internally generated IDs (like a Reltio ID) behave like a token, and data tagged with these reference numbers is pseudonymized.
- Pseudonymized data is GRPR regulated and needs to be treated exactly like PII, but it carries a lower risk profile with respect to data breach and fines.
- A Reltio ID, Customer ID or Person # can't be used by a non-authorized party to identify a guest or employee (as per your comment on Reltio being protected by security)
- Data is anonymized when it it "fully deidentified", in other words no way to reference back to the PII. A common example would be to mask the PII (including the ID) with "XXXXXXXXXX"
- Anonymized data is not GDPR regulated.
So, using your examples, breaching a list of 1MIL phone numbers is quite bad, and would need to be reported and the fines would be heavy. Breaching 1MIL Reltio IDs is not so bad, may not need to be reported, and the fines would be relatively light - if any.
Regards,
Walt
------------------------------
Walt Feldman
Solutions Architect
Tenerity
------------------------------
Original Message:
Sent: 10-14-2021 17:51
From: Gino Fortunato
Subject: If the dataset contains PII information, is there any option for tokenizing it before loading it into Snowflake?
Thanks Walt,
Perhaps I don't fully understand the definition of anonymizing and pseudonymizing (definitions I found on google were not helpful here) but does it make a difference that data in Reltio is protected by security?
I'm trying to compare knowing someone's Reltio ID with someone's phone number. With a phone number I can do a reverse lookup on public data sets and find PII. But if I have a Reltio ID, I still need authorization to the Reltio tenant to get the PII. While in the end I can get PII either way, it seems that we should differentiate from a security perspective data a lookup that is protected with one that is not. Does that seem reasonable to you?
Thanks,
------------------------------
Gino Fortunato
Senior Solution Engineer
Reltio
Original Message:
Sent: 10-13-2021 17:03
From: Walt Feldman
Subject: If the dataset contains PII information, is there any option for tokenizing it before loading it into Snowflake?
Just a few things to keep in mind relative to having PII in Reltio and sending selected attributes downstream:
- If one of the attributes being sent downstream is a customer ID, person number or Entity ID, and you can use that value to access the PII in Reltio, you are pseudonymizing the data, not anonymizing the data. While this is certainly not a "bad thing", you cannot claim that the downstream data is "fully deidentified".
- In the above case, the ID is a form of tokenization, and the ID is actually PII, because it can be used to reference PII.
- In order to claim the data is "fully deidentified" or "anonymized" and therefore not PII, you need to remove any reference back to the actual PII
------------------------------
Walt Feldman
Solutions Architect
Tenerity
Original Message:
Sent: 10-13-2021 09:43
From: Prasad Satam
Subject: If the dataset contains PII information, is there any option for tokenizing it before loading it into Snowflake?
Hi @Sima Khamitkar, great question!
You can skip attributes. So if you have PII data in a Reltio, which you don't want to put it into Snowflake, then you can skip it, so that's what we have option. You have option to say what attributes you want to ignore. So it does not select, if you add new attributes, it automatically comes to the Snowflake. But if you want to have skip some attributes, like PII data, we have that option, but we are not doing any transformation tokenization, all those things.
Check out the webinar I did on Reltio Connected Platform with Snowflake:
------------------------------
Prasad Satam
Original Message:
Sent: 10-13-2021 09:31
From: Sima Khamitkar
Subject: If the dataset contains PII information, is there any option for tokenizing it before loading it into Snowflake?
Is this a possibility?
------------------------------
Sima Khamitkar
Director Enterprise Data Architecture
Fidelity Investments
Ashland MA
------------------------------