Per-user pseudonymization component

[rcrowe-google]

A component can be developed to do per-user pseudonymization, which pseudonymizes selected features while retaining consistency for each user.

First, the component is given two lists of feature names:

1. The features which identify a user, such as first and last name, user ID, etc.
2. The additional features which should be pseudonymized

Each user's identifier(s) are mapped to pseudonymized identifier(s), which are consistently used to replace the original identifier(s) for all examples for that user. For example, in the output the user "Barney Rubble" might always be given the name "Fred Flintstone", so that multiple examples for Barney can be analyzed as a group. This requires the creation of a map of user identifier(s) to pseudonymized user identifier(s), which can be done as data is read, without a full pass over the data. Note that different users with the first name of Barney should be given different pseudonymized first names, to avoid revealing the mapping.

Additional feature values will also be mapped and pseudonymized consistently. For example, "California" might always be given the name "Xanadu" (or actually the result of an pseudonymization algorithm, but you get the point).

Note that this is not full anonymization, and retains the information in the data while providing reasonably strong privacy protection. This is highly recommended by the GDPR.