Based on what I learned in my past professional life and what the experts have told us, there is no technique that completely ensures that a person cannot be reidentified. The fact is that there are a number of methods of reidentification that can be used together, including using the data in motion.
What is the acceptable risk, and who determines that?
In that context, who determines what methods are acceptable based on the level of risk deemed acceptable at a specific time?
You have to understand that this is all evolving very quickly. I repeated the word “acceptable” several times, but you understand what I mean.
Who determines that? Apart from the fact that the bill is proposed in good faith, there is not much.