Research at MIT reveals credit card data not as anonymous as thought

Research at Massachusetts Institute of Technology (MIT) has revealed that it is possible to identify individuals through credit card metadata.

According to MIT researchers they do not need an individual's name, address, or credit card number, which are typically thought of as personal information, to identify people within a data set.

Instead, they claim using four vague pieces of information, such as the dates and locations of four purchases, it is possible to identify 90 per cent of the people in a data set recording three months of credit card transactions by 1.1 million users.

"We are showing that the privacy we are told that we have isn't real," study co-author Alex "Sandy" Pentland of MIT said in an email.

Taking the issue further, researchers considered whether it was enough to identify an even larger percentage of people in the data set if it used three data points, which included at least one that revealed the price of the purchase.

The research finally revealed that there was a 94-per cent chance of extracting credit card records from those of a million other people.

The researchers considered whether they could preserve anonymity in large data sets by intentionally making the data less precise, in order to examine whether preserving privacy would still enable useful analysis.

The researchers found that even if the data set was characterised as each purchase having taken place in the span of a week at one of the 150 stores in the same general area, it would be possible to identify 70 per cent of users' with four of their purchases.

netnebraska.org reported that out of an anonymous set of credit card data from millions of people, researchers found out that three pieces of outside information was needed to correctly identify a person in an anonymous data set - even when the data removed easy identifiers like credit card numbers, names or addresses, according to Yves-Alexandre de Montjoye, a graduate student in media arts and sciences from the Massachusetts Institute of Technology.

According to a study in yesterday's issue of Science, a crafty user had a 94 per cent chance of tracking an individual's purchases with three pieces of extra information - one receipt, an Instagram of his lunch, a Tweet about the new shoes he / she bought or Facebook post tagging the bar where he/she went for happy hour.

(Read more: Privacy challenges : its easy to identify individuals from their credit card metada)