Individuals can be identified by credit card metadata, even when information that we see as important like name, address or credit card number has been stripped out. These are some of the findings of a study, titled “Unique in the Shopping Mall: On the Reidentifiability of Credit Card Metadata,” published on Friday in the journal Science.

Over a three-month period, a group of data scientists analyzed credit card transactions made by 1.1 million people across 10,000 stores. The metadata only included details about the date of each transaction, the shop type and the amount spent. According to the study, combining as few as four data points with publicly available information, such as social media posts on services like Instagram or Twitter, the scientists could correctly connect 90 percent of consumers with their credit card purchases.

The lead author of the study is Yves-Alexandre de Montjoye, who is an applied mathematician at the Massachusetts Institute of Technology in Cambridge. He talks about the fact that because spending patterns are so unique, the data collected has a very high “unicity”. This uniqueness is what exposes individuals to what de Montjoye calls a “correlation attack”. According to the study, revealing someone’s identity is a matter of correlating “the metadata with information about the person from an outside source.”

One such “correlation attack” took place in June last year when the New York City Taxi and Limousine Commission released data for 173 million taxi trips. The data included times, routes, and cab fares, but no names. However, once the taxi medallion numbers were deciphered, individuals, most notably celebrities, could be linked with the data.

“The message is that we ought to rethink and reformulate the way we think about data protection,” said de Montjoye. “The old model of anonymity doesn’t seem to be the right model when we are talking about large-scale metadata.”

At this stage the wealthy country where the research took place remains unnamed.

photo credit: Shopping at Simons via photopin cc.