Method for anonymization of data collected within a mobile communication network

A method for processing a plurality of event data sets collected within a system or network providing a service for subscribers, wherein

• the event data sets include attributes containing time when an event took place, information about location where the event was triggered and type of event, and
• event data sets are associated with an anonymized personal identifier identifying a subscriber who triggered said event in the mobile communication network, comprising:
• collecting the plurality of event data sets, wherein each of the event data sets is related to an individual subscriber of the system/network and includes at least one attribute including a location attribute;
• determining one or more first event data sets having identical or nearly identical values for an attribute of a first location, the one or more first event data sets being selected from the collected plurality of event data sets;
• counting a number of first different subscribers associated with the first event data sets having the identical or nearly identical values for the attribute of the first location;
• and
• determining the first event data sets as approved for being transmitted to an external device when the number of the first different subscribers exceeds a defined threshold;
• determining one or more second event data sets having identical or nearly identical values for an attribute of a second location, the one or more second event data sets being selected from the collected plurality of event data sets;
• counting a number of second different subscribers associated with the second event data sets having the identical or nearly identical values for the attribute of the second location;
• determining the second event data sets as disapproved for being transmitted to the external device when the number of the second different subscribers does not exceed the defined threshold;
• transmitting the first event data sets to the external device together with the associated anonymized personal identifiers;
• and
• performing anonymization on the second event data sets, wherein
• the performing anonymization further comprises deleting all personalized information included in the second event data sets, including the anonymized personal identifier,
• the anonymization is achieved by deleting the personal identifiers from those event data sets which have been triggered within a geometrical region by insufficient different subscribers, and
• if the collected event data sets are triggered by a sufficient number of different subscribers, the event data sets are sent to the external device together with the anonymized identifiers.