The motivated-intruder test
|“||requires organizations to consider whether individuals could be re-identified from the anonymized data by someone who is reasonably competent, has access to resources, such as the internet and would employ investigative techniques, such as making enquiries of people who may have additional knowledge of the identity of the data subject. The motivated intruder is not assumed to have any specialist knowledge.||”|
"Clearly, some sorts of data will be more attractive to a 'motivated intruder' than others. Obvious sources of attraction to an intruder might include:
- finding out personal data about someone else, for nefarious personal reasons or financial gain;
- the possibility of causing mischief by embarrassing others;
- revealing newsworthy information about public figures;
- political or activistic purposes, eg as part of a campaign against a particular organisation or person; or
- curiosity, eg a local person's desire to find out who has been involved in an incident shown on a crime map.
The ‘motivated intruder’ test is useful because it sets the bar for the risk of identification higher than considering whether a 'relatively inexpert' member of the public can achieve re-identification, but lower than considering whether someone with access to a great deal of specialist expertise, analytical power or prior knowledge could do so. It is therefore good practice to adopt a 'motivated intruder' test as part of a risk assessment. Carrying out a motivated intruder test in practice might include:
- carrying out a web search to discover whether a combination of date of birth and postcode data can be used to reveal a particular individual's identity;
- searching the archives of national or local newspaper to see whether it is possible to associate a victim's name with crime map data;
- using social networking to see if it is possible to link anonymised data to a user's profile; or
- using the electoral register and local library resources to try to link anonymised data to someone's identity."
- Bridget Treacy, "Big data: How firms can exploit it without breaking privacy laws" (Nov. 29, 2012) (full-text).
- Anonymisation: Managing Data Protection Risk, Code of Practice, at 24.