Blinding Identity Taxonomy

Version:                        1.0

Document Date:                2020-06-15

Editors:                        Paul Knowles, John Wunderlich, Ken Klingenstein

Contributors:                        See Section 6.2 Participants

                                ISI Work Group Participant Roster

Produced by:                        Information Sharing Interoperability Work Group

                                https://kantarainitiative.org/groups/isi-work-group/ 

Status:        

This document is a Group-Editors' DraftReport produced by the Information Sharing Interoperability Work Group. See the Kantara Initiative Operating Procedures for more information on Kantara Reports, Recommendations and Specifications.

Abstract:

The BIT is a taxonomy of data fields to be blinded for the purpose of removing identity data from a dataset.

Copyright Notice: Copyright © 2020 Kantara Initiative and the persons identified as the document authors. All rights reserved. This document is subject to the Kantara IPR Policy -

IPR Option: Non-Assertion Covenant

Suggested Citation:

Blinding Identity Taxonomy 1.0. Kantara Initiative Information Sharing Interoperability Work Group. 2020-06-15. Kantara Initiative Report.

NOTICE

-

IPR Option: Non-Assertion Covenant

Copyright: The content of this document is copyright of Kantara Initiative, Inc.© 2020 Kantara Initiative, Inc.

Dear reader

Thank you for downloading this publication prepared by the international community of experts that comprise the Kantara Initiative.  Kantara is a global non-profit ‘commons’ dedicated to improving trustworthy use of digital identity and personal data through innovation, standardization and good practice.  'Nurture, Develop, Operate' - that’s what Kantara does.

Kantara is known around the world for incubating innovative concepts, operating Trust Frameworks to assure digital identity and privacy service providers and developing community-led best practice and specifications.  Its efforts are acknowledged by OECD ITAC, UNCITRAL, ISO SC27, other consortia and governments around the world

Every publication, in every domain, is capable of improvement.  Kantara welcomes and values your contribution through membership, sponsorship and active participation in all our endeavors including in the working group that produced this publication. With your contribution, Kantara can reflect its value back to you and your organization while continuing to consolidate an inclusive, equitable digital economy offering value and benefit to all.

Contents

1        Executive Summary        4

2        Introduction        5

3        Blinding Identity Taxonomy        6

3.1        Scope        6

3.2        Definitions        6

4        Profiles and Schemas        8

4.1        Profiles        8

4.2        Schemas        8

5        Conclusion        9

6        Appendices        10

6.1        How the BIT came to be        10

6.2        Participants        10

6.3        References and Useful Links        10

6.4        BIT Fields & Notes        11

Tables

Table 1 Participant List        10

Table 2 References and Useful Links        10

Table 3 Blinding Identity Taxonomy        13

1. Executive Summary

Identifiers and attributes are the payloads that are exchanged in the identity landscape. Identifiers are assumed to have some correspondence with the entity they refer to. Attributes are generally seen to be characteristics possessed by multiple entities. When entities have a business requirement to process information they may or may not require identifiers or identifying attributes.  From a privacy perspective, processing or sharing fewer identifiers or identify attributes reduces risk. Unauthorized access or use to a dataset exposes identifiers and hence identities. Correlation attacks attempt to use multiple attributes of an end-entity to identify an individual. Meta-data about a dataset can be mined to infer personal information.

The purpose of BIT is to provide a defensive tool against re-identification attacks against a dataset AND to make Datasets more useful for a range of purposes. The Blinding Identity Taxonomy (BIT) outlined in this Kantara Report is therefore intended to be a practical tool for practitioners whose organization have custody or control of a dataset that contains identifiable information about entities. These entities may be, but are not necessarily, natural persons. The purpose of the tool is to provide the ability of an organizations that wants to store, use or share datasets with a reasonable claim that the dataset does not contain identifying information about entities. A reasonable claim may depend on the use of additional controls in addition to the application of the BIT, such as contracts or security controls. These additional controls are out of scope of this report.

The BIT is a list of field and categories of fields that may be contained in a dataset. Where a real-world instance of a dataset contains these fields, they will be blinded by being encrypted or excluded from the ‘blinded’ dataset in such a way that the resulting dataset no longer contains readable data in any of the defined fields. See BIT Fields & Notes below for details on the BIT.

The Kantara Initiative is publishing this report as a service to the identity community to provide another tool for identity practitioners looking for practicable methods to reduce risk and meet business goals. We hope that practitioners that can use this taxonomy are able to share their experiences with the community to be able to identify common profiles and schemas that will facilitate adoption of the Blinding Identity Taxonomy. Version 1.0 of the report includes a high-level view of profiles and schemas that practitioners can use for their particular use cases.

2. Introduction

The Blinding Identity Taxonomy (BIT) was first created in 2018 with the aim of providing a common reference or practice to enable the protection of identities. For the purposes of this report identity refers to the attributes of a natural person or organization or a device with signing capabilities that make that entity uniquely identifiable^[1]. BIT can be used to flag a list of elements which require cryptographic encoding to reduce the risk of identifying a data principal. When those elements have been removed or encrypted, the dataset is ‘blinded’. For the purposes of this report, a dataset may be said to be successfully ‘blinded’ when an adversary with access to the dataset cannot identify a significant number of the data principals contained in the dataset. This recognizes that no blinding effort is risk free and allows blinding organizations to determine the level of risk of unblinding that is appropriate for their contexts.

This report is being published by the Kantara Initiative as a resource to the identity and information sharing community to assist policy makers and technologists to make decisions about where and how to apply blinding techniques to Datasets with identity attributes. The authors hope that real world use cases, profiles and schemas will be contributed to future versions.

3. Blinding Identity Taxonomy

1. Scope

This report provides a description of the Blinding Identity Taxonomy (BIT), to be used for the purpose of blinding datasets by removing or encrypting fields containing identifying information about data principals. The report assumes that an entity has custody or control of a dataset that contains identifying information about entities. The goal of entities that choose to use the BIT will be to process that dataset, or a copy of it, with the ability to make a reasonable claim that the resulting ‘blinded’ dataset does not contain identifying information about data principals. A ‘reasonable’ claim may depend on other controls, such as administrative, physical or technical controls that are out of scope of this report.

2. Definitions

For the purpose of this report the following definitions apply. Where possible existing standard definitions are referenced^[2].

4. Profiles and Schemas

The Blinding Identity Taxonomy (BIT) can be used to select the fields that should be encrypted except where those fields are in use and unblinding is required for the use. In this context the BIT can determine what should be encrypted at rest and in motion. Another use of the BIT is to use profiles and schemas to enable identity safe uses of data.

By using profiles and schemas practitioners may be able to automate the application of the BIT and produce multiple blinded datasets relatively easily. A typical use case that might lead to a profile is this. A medical researcher wants to do a chart review for a research study. As part of their ethical review process they determine that they can use blinded data because they are only interested in clinical data, not identifying data. The researcher reviews the data dictionary or fields available to them in charts (the field definitions, not the contents) resulting in a description of the fields that they would like to ‘pull’ for their chart review. They then review the fields against the BIT and determine if they want to use a field that should be blinded. They can then choose a number of options for blinding that field, including format preserving encryption or by combining a set of attributes into a single attribute (replacing full date of birth with age at start of study period, for example). Once the blinding process has been identified it can be applied to the original data set to produce the blinded data set for review.

Should the process prove useful, this blinding process can then be generalized and captured in a profile that defines the fields that will be extracted and a description of the blinding process on a field by field basis. Where the extract is in a defined structured format like JSON or JSON-LD, a schema for that data export can also be attached.

3. Profiles

Profiles are subsets of available data. A profile will typically be a list of fields, with a specification of each field type and its characteristics for inclusion in the destination dataset. For fields that are listed above as part of the taxonomy and that will be included in the destination dataset, the profile may recommend a type of encryption.

When data is collected or captured a profile will be used to select and or transform the data that is added to a dataset or database. In some contexts, profiles can be used as a form of data minimization to ensure that the only data that will be entered into a dataset or database is data that is necessary for the purpose for which the dataset or database was created. In all cases, profiles will enable more effective ETL^[4] routines.

In a medical research or clinical assessment context for example, a profile sets out the elements of a patient’s health record that are required for a research project or assessment. To the extent feasible in the context this may also converting free form text fields to defined content fields to better enable machine processing using schemas. An example would be the conversion of a text diagnosis to its corresponding ICD code^[5].

Profiles will, if shared, enable blinded data interoperability between organizations.

4. Schemas

A schema is a machine-readable data structure that defines the semantics of the data contained in the structure. A well-defined schema will contain a group or groups of related attributes that, when amalgamated, will provide a concise context which can be summarised and captured in the metadata block of the data structure.

5. Conclusion

The Blinding Identity Taxonomy is a tool to enable implementers to safeguard their data from unauthorized or inappropriate uses. The use of BIT as a de-identification technique will enable implementers to provide stakeholder assurances about their datasets. We hope that this will prove to be useful and practical guidance for implementers.

6. Appendices

1. How the BIT came to be

The Blinding Identity Taxonomy (BIT) was conceived on April 4th, 2018 on the second day of the 26th edition of the Internet Identity Workshop (IIW) at the Computer History Museum in Mountain View in a private conversation regarding the technical limitations of the EU’s General Data Protection Regulation (GDPR) which was due to be enforced the following month on May 25th.

The first draft of listed elements was produced by Paul Knowles, Jan Lindquist (then OTT Analytics Specialist, Dativa) and Tom Weiss (CTO and Chief Data Scientist, Dativa) following blanket review from various members of the Identity and Big Data communities and was subsequently published as a Dativa blog post titled “The blinding identity taxonomy initiative” on September 6th, 2018^[6] which was authored by Paul Knowles.

The intellectual property rights for the BIT were transferred to Kantara Initiative’s Consent Information Sharing work group (CIS-WG) in December 2018 and re-contributed to the newly formed Information Sharing Interoperability work group (ISI-WG) by Paul Knowles^[7] and Jan Lindquist^[8] on January 22nd, 2020.

2. Participants

The following individuals participated in the creation of this document. For a complete list of participants see the Information Sharing Interoperability Work Group (WG-ISI) Participant Roster: https://kantarainitiative.org/confluence/display/WGISI/Participant+Roster 

Table 1 Participant List

3. References and Useful Links

Table 2 References and Useful Links

4. BIT Fields & Notes

The field(s) below may be represented by single or multiple fields in your application. The overall suggested approach is to be conservative. When reviewing the contents of your dataset against the taxonomy, you should encrypt if the taxonomy might apply, rather than taking a narrow approach. You may find that a field in your dataset might fall within more than one category. That is to be expected as the definitions are somewhat, and intentionally, fuzzy. More precise or prescriptive definitions are the purview of profiles and schemas, where the population of possible field categories can be prescribed or defined more precisely.

Table 3 Blinding Identity Taxonomy