A health organization experienced a breach of a database containing pseudonymized personal data. Which of the following should be of MOST concern to the IT privacy practitioner?

Question

Options

• AThe data may be re-identified.
• BThe data was proprietary.
• CThe data was classified as confidential.
• DThe data is subject to regulatory fines.

• A
  72% (33)
• B
  17% (8)
• C
  7% (3)
• D
  4% (2)

Explanation

Pseudonymization replaces direct identifiers (e.g., names) with artificial identifiers (pseudonyms), but the underlying personal data still exists and the mapping can potentially be reversed. If an attacker obtains the pseudonymized dataset along with additional contextual data or the key/mapping table, they can re-identify individuals - fully exposing their health information. This is the primary privacy risk that distinguishes a pseudonymization breach from, say, a breach of anonymized data. Options B and C (proprietary/confidential classification) are relevant security concerns but are secondary to the re-identification risk specific to pseudonymized data. Option D (regulatory fines) is a consequence, not the core technical concern - and fines are a result of the re-identification risk materializing.

No community discussion yet for this question.