Going Beyond Obscurity: Organizational Approaches to Data Anonymization

Anonymization is viewed as a solution to over-exposure of personal information in a data-driven society. Yet how organizations apply anonymization techniques to data remains under-explored. We investigate how such measures are applied in organizations through a small-scale interview study, asking whether anonymization practices are used, what approaches are considered practical and adequate, and how decisions are made to protect the privacy of data subjects while preserving analytical value. Our findings suggest that applying anonymization is a complex socio-technical process and it is less common than we had originally expected. Organizations that employ anonymization often view their practices as sensitive and resort to anonymity by obscurity alongside technical means. Rather than being a purely technical question of applying the right algorithms, anonymization in practice relies on multi-stakeholder collaborations across organizational boundaries. Here we observe engagement of what Suchman has called "multiple, located, partial perspectives" in ongoing discussions necessary to negotiate the technical as well as organizational complexities of implementing data anonymization.