legalreport TSUL Legal Report TSUL Legal Report 2181-1024 Toshkent davlat yuridik universiteti 10.51788/tsul.lr.5.1./tcyn1311 REL-A-013985 DE-IDENTIFICATION AND ANONYMIZATION: LEGAL AND TECHNICAL APPROACHES Mamanazarov Sardor 01 01 2024 2024 5 1 25 37 https://creativecommons.org/licenses/by-nc-sa/4.0

This study analyzes legal and technical approaches to data de-identification and anonymization, motivated by the need to develop balanced standards that preserve privacy without stifling beneficial data uses. Doctrinal and technical literature review methods examine provisions in major data protection laws worldwide, including the EU‘s GDPR, US HIPAA, and emerging frameworks in China, India, and Uzbekistan, alongside mathematical models like differential privacy and k-anonymity. The legal analysis reveals common themes like flexible research exemptions for anonymized data and calibrating standards based on sensitivity, but also gaps such as ambiguities around pseudonymization. The technical review highlights the strengths and weaknesses of encryption, perturbation, generalization, and federation techniques, emphasizing the need to complement mathematical methods with governance controls. Key findings include the importance of allowing contextual optimization, providing detailed regulatory guidance, and addressing re-identification incentives. Recommendations are provided for advancing Uzbekistan‘s data protection laws and practices based on international experiences, such as enabling public oversight, conducting localized impact assessments, and promoting privacy-enhancing technologies. The study concludes that to anonymize data in a way that enables research while also protecting people‘s rights, we need a comprehensive approach that includes laws, organizational rules, technical safeguards, ethical decision-making, and public input. All of these parts working together is important for successful data anonymization.

 data protection anonymization de-identification personal data law data confidentiality differential privacy re-identification Ohm P. Broken promises of privacy: Responding to the surprising failure of anonymization. UCLA Law Review, 57, 2010, pp. 1701–1777. Barocas, S., & Nissenbaum, HBig data’s end run around anonymity and consent. In J. Lane, V. Stodden, S. Bender, & H. Nissenbaum (Eds.), Privacy, big data, and the public good: Frameworks for engagement, 2014, pp. 44–75. Cambridge University Press. 10.1017/cbo9781107590205.004 Narayanan, A., & Shmatikov, V. Robust de-anonymization of large sparse datasets. In Proceedings of the 2008 IEEE Symposium on Security and Privacy, 2008, pp. 111–125. IEEE. 10.1109/sp.2008.33 Schwartz, P. M., & Solove, D. J. Reconciling personal information in the United States and European Union. California Law Review, 2014, 102(4), pp. 877–916. Dwork, C. Differential privacy. In Proceedings of the 33rd International Colloquium on Automata, Languages and Programming, 2006, pp. 1–12. Springer. 10.1007/11787006_1 Sweeney, L. K-anonymity: A model for protecting privacy. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 2002, 10(05), pp. 557–570. 10.1142/s0218488502001648 Information Commissioner’s Office (ICO). Anonymisation: Managing data protection risk code of practice, 2012. Available at: https://ico.org.uk/media/for-organisations/documents/1061/anonymisation-code.pdf European Data Protection Board (EDPB). (2020). Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak. Available at: https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-042020-use-location-data-and-contact-tracing_en Ministry of Electronics and Information Technology (MEITY), Government of India. (2022). Sensitive Personal Data or Information (SPDI) Rules. Available at: https://www.meity.gov.in/writereaddata/files/Personal_Data_Protection_Bill,2018.pdf International Organization for Standardization (ISO). (2018). ISO/IEC 20889:2018 Privacy enhancing data de-identification terminology and classification of techniques. Available at: https://www.iso.org/standard/69373.html Gentry, C. Fully homomorphic encryption using ideal lattices. In Proceedings of the 41st Annual ACM Symposium on Theory of Computing, 2009, pp. 169–178. ACM. 10.1145/1536414.1536440 Gilad-Bachrach, R., Dowlin, N., Laine, K., Lauter, K., Naehrig, M., & Wernsing, J. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In Proceedings of the 33rd International Conference on Machine Learning, 2016, pp. 201–210. JMLR. Gupta, O., & Raskar, R. Distributed learning of deep neural network over multiple agents. Journal of Network and Computer Applications, 116, 2018, pp. 1–8. 10.1016/j.jnca.2018.05.003 Konečný, J., McMahan, H. B., Yu, F. X., Richtárik, P., Suresh, A. T., & Bacon, D. (2016). Federated learning: Strategies for improving communication efficiency. arXiv preprint arXiv:1610.05492. TF Privacy Team. TensorFlow Privacy, 2020. Available at: https://github.com/tensorflow/privacy Wainwright, M. J., Jordan, M. I., & Duchi, J. C. Privacy aware learning. In Advances in Neural Information Processing Systems 25, 2012, pp. 1430–1438.