Computer scientists in the US have discovered ways to "re-identify" the names of people included in supposedly anonymous datasets.
In one example, a movie rental company released an anonymous list of film-ratings taken from its 500,000 subscribers. Using a statistical "de-anonymisation" technique, the academics were able to identify individuals and their film preferences.
The discovery raises concerns about how safe it is to release personal information – such as medical records or mobile phone data – even if details such as names or national insurance numbers have been removed. There are fears the information could be accessed by criminals.
The discovery has led British researchers to raise the issue in a report they are writing for the European commission. Dr Ian Brown, of the Oxford Internet Institute and a co-author, said the example of the film list was relatively trivial. "But this raises concerns for more sensitive data such as medical records. Epidemiologists say they could do interesting research if they had access to more anonymous data. This shows it is difficult to do that in a way that can't be reversed."
One concern is that criminals could identify individuals through mobile phone data and use the information to track people's movements and find out when they are away from home. "That is one worry. Other people who you might worry about accessing that information include employers, insurers or the government. There are a whole range of potential users," Brown said.
Experts say the discovery that lists can be "de-anonymised" needs to be included in the debate about how information is released and where to draw the line. But they also highlight the benefits of letting researchers and others access large datasets.
Last week Sir Tim Berners-Lee, inventor of the world wide web, launched a new website – data.gov.uk – on which members of the public will be able to access information on crime rates, exam results, house prices and more.
"They are talking about non-personal data," said Brown. "But another thing they are looking at releasing is crime reports down to street level. You have to think about how people might be able to link that back to individuals."
William Heath, founder of Ctrl-Shift, which specialises in how personal data are used, said: "If you take it in the light of Friday's news about data.gov.uk, the government has clearly done something really good to make public data available. Now they need a more enlightened approach to personal data, but you can't simply say anonymised data can be safely made public because it is clear how hard it is truly to anonymise data."