A transit ridership model trains on supposedly de-identified tap data that analysts show is still re-identifiable. What should audit emphasize?

Audit should emphasize that de-identification quality is inadequate and residual re-identification risk must be treated as unresolved privacy risk. Transit ridership models trained on "de-identified" tap data that analysts can still re-identify have not achieved effective anonymization. Privacy and data governance for civic AI assess the strength of de-identification under realistic linkage attacks, not the comfort of a label on a dataset.

Any claim that hashed card identifiers improve anonymization for longitudinal tap trajectory analysis fails because hashing is only pseudonymization; stable hashes can still be linked across trips and combined with auxiliary data to re-identify riders, leaving residual risk unresolved. Treating station-level aggregation of outputs as sufficient to address linkage risk from individual travel patterns used for training fails conceptually: output masking does not equal training-data anonymization, and the model still learns from re-identifiable individual trajectories. Relying on restricted analyst access controls in the training environment to contain residual re-identification risk in the original source tap data fails because access limits are a compensating control, not a fix for inadequate de-identification; the underlying privacy risk remains unless the data itself is re-tested and mitigated.

Exam caveat: “analysts showed re-identifiability” should trigger specific remediation (further suppression, aggregation, access limits)—not only a risk note that remains untreated. Operational check: retain the re-identification test evidence, elevate residual risk on the register until mitigations pass a repeat test, and restrict model-training use of the weak de-id set in the interim.