PII Detection and Masking — References

What counts as identifying under the main regimes, the research showing why span-level removal is not enough, and the shared task that defines how a detector is scored.

What has to be removed

• Guide to Protecting the Confidentiality of Personally Identifiable Information — NIST Special Publication 800-122. The working definition of linked and linkable information and a confidence framework for deciding which fields are which, which is the most practical published basis for arguing about a class list. Cited by name.
• Regulation (EU) 2016/679, the General Data Protection Regulation — cited here for the definition of personal data in Article 4(1) and for the treatment of pseudonymisation as a security measure that keeps data in scope, which is the legal reason reversible tokenisation is not anonymisation. Cited by name; consult the official text for operative wording.
• The HIPAA Privacy Rule de-identification standard at 45 CFR §164.514, including the safe-harbour enumeration of identifier types and the alternative of expert determination. Useful far outside healthcare as the only widely adopted, concrete list of what must go. Cited by name.

Why removing the obvious spans is not enough

• Simple Demographics Often Identify People Uniquely — Latanya Sweeney, Carnegie Mellon University, 2000. The measurement that a small number of coarse attributes identifies most of a population, which is the evidence behind treating quasi-identifiers as in scope. Cited by name.
• k-Anonymity: A Model for Protecting Privacy — Latanya Sweeney, International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 2002. The formal property a masked dataset might satisfy, and the generalisation and suppression operations that achieve it. Cited by name.
• Robust De-anonymization of Large Sparse Datasets — Arvind Narayanan and Vitaly Shmatikov, IEEE Symposium on Security and Privacy, 2008. Re-identification from sparse behavioural records with no direct identifiers present, which is the case a span detector cannot see by construction. Cited by name.
• The Algorithmic Foundations of Differential Privacy — Cynthia Dwork and Aaron Roth, Foundations and Trends in Theoretical Computer Science, 2014. The formal alternative to redaction, included here for its argument that privacy is a property of a release mechanism rather than of a document. Cited by name.

Scoring a detector

• Introduction to the CoNLL-2003 Shared Task: Language-Independent Named Entity Recognition — Erik F. Tjong Kim Sang and Fien De Meulder, Conference on Natural Language Learning, 2003. The span-level evaluation convention that entity detectors are still scored against, and the origin of the partial-overlap problem that makes reported figures hard to compare. Cited by name.

No verified reference is recorded for placeholder-consistency scoping, for measured recall of commercial detectors on production conversational text, or for the downstream quality cost of masking before inference. The regulatory texts say what must be removed and the research says why removal is insufficient; the engineering trade-offs are undocumented.