Another element in this discussion to align on, is the notion that there are different categories of personal data types that will often drive or determine the best privatization approach. One common way to view this is to use the concepts of direct, versus indirect personal data or identifiers. So looking at some examples, direct identifiers which are also sometimes referred to as unique identifiers, have a typically a one-to-one style of relationship between the identification value and the person or the data subject. These range from things like national identifiers, or online IDs, and account numbers. Policy numbers, e-mail address, IP addresses, some even feel that names and addresses can also be included in this category even though they can often apply in the case of addresses to more than one individuals, such as with households, facial images, genetic specific data, and biometric data. These are all directly connectable to an individual. The net here is that if the value alone can be used to identify the data subject, we want to consider classifying it as a direct identifier. With respect to indirect identifiers, these are often some of the most sensitive personal data, even though they might be shared among various data subjects in the population. Things like physical attributes, or genetic, or mental, or economic characteristics, cultural, or social attributes, things like buying preferences, or buying histories, racial or ethnic origin information, political opinions, religious and philosophical beliefs, organization and trade union memberships, various health data or history, and any information concerning sexual orientation. The net is these usually require some form of de-identification, and it's typically in the category of anonymization, which is adding some kind of noise or generalization that partially, or possibly completely masks or redacts the values, such that these are no longer connectable in any way to reidentify the data subject. For direct identifiers, it's common to use some form of tokenization, also referred to as pseudononymization, to visually negate the face value of the element, while preserving typically some degree of the entity's uniqueness. This assumes the approach being used is a repeatable tokenization approach. But be aware of that, because of this uniqueness preservation, repeatable tokenization alone versus some random tokenization approach, is not considered by most to be complete de-identification. Other techniques will need to be applied. For indirect identifiers, really any of the data applied privatization techniques that we'll discuss in this section in more detail, are candidates for application. But more commonly, we'll need some anonymization approach that needs to protect against the data, subject, inference, or reidentification. But this needs to be balanced with preserving an appropriate degree of data utility, or statistical distribution, or accuracy. This goal can be more or less complicated, depending upon the data in question, and the use cases, and the targeted zones for use. So let's review some of these techniques in more detail.