Investigating privacy risks in open government data: an exploratory case study

Abstract

Introduction. As governments increasingly release large datasets to the public, concerns have arisen regarding the potential risks associated with the inadvertent disclosure of personal information. However, there are few empirical case studies of this phenomena.

Method. Taking a red teaming approach, we collected public, nonprofit reporting documents from the IRS, as well as a list of professional athletes. Using standard data processing techniques, we attempt to identify and evaluate the personal information that can be attached to these notable individuals in order to propose a framework describing how features of information, people and processes influence the potential release of personal information.

Findings. We find that name commonness plays a large role in determining the feasibility of matching records. We also find that personal information, including addresses and business relationships, are accessible in the dataset.

Conclusion. Our exploratory case study suggests several features of information, people and processes that influence the release of private information held in open government data. While limited, it suggests the value of further work in the area.