PLA today posts a link to “Unique in the Shopping Mall: On the Reidentifiability of Credit Card Metadata,” which concludes that card transaction data that was anonymized in conventional ways (e.g., by removing names and account numbers) can, in 90% of cases, nevertheless be reidentified using a small number of random and publicly available data points. If valid, this conclusion would seem to call into question such provisions as Section 3(q)(2)(ii)(B) of Reg P, which states that “Personally identifiable financial information does not include . . . [i]nformation that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses.” PLA will report further as this matter develops.