Would revised surveillance law protect all personal data?
Would revised surveillance law protect all personal data? Recently, content providers including Google and Microsoft have been racing to comply with dueling sets of governments’ provisions worldwide: one that mandates how long they must retain information about their customers, and another that mandates they must anonymize that data, or get rid of it, after a given period of time. But as university researchers including Harvard’s Christopher Soghoian demonstrated, anonymization with respect to single databases may be pointless, as engineers with only meager knowledge of how databases work could conceivably reconstruct personally identifiable data by linking records from multiple databases. This gets into the larger question of aggregate data — information that’s discoverable through manipulation. The principles proposed by Digital Due Process yesterday appear, on the surface, to apply to law enforcement requests for specific records from specific databases applicable to specific inves
