Testing the robustness of anonymization techniques: acceptable versus unacceptable inferences

International audience; Anonymization is a critical issue because data protection regulations such as the European Direc-tive 95/46/EC and the European General Data Protection Regulation (GDPR) explicitly excludefrom their scope \anonymous information" and \personal data rendered anonymous"1. However,turning this general statement into effective criteria is not an easy task. In order to facilitate theimplementation of this provision, the Working Party 29 (WP29) has published in April 2014 anOpinion on Anonymization Techniques2. This Opinion puts forward three criteria correspond-ing to three risks called respectively "singling out", "linkability" and "inference". In this paper,we first discuss these criteria and suggest that they are neither necessary nor effective to decideupon the robustness of an anonymization algorithm (Section 2). Then we propose an alternativeapproach relying on the notions of acceptable versus unacceptable inferences (Section 3) and weintroduce differential testing, a practical way to implement this approach using machine learningtechniques (Section 4). The last section discusses related work and suggests avenues for futureresearch (Section 5).