Consider the following scenario: Assume you work for a telecom company as a data manager and your bosses decide to release/sell some account characteristic data on good customers to another company with whom your firm has a partnership. Before you can release your dataset, however, it must first be scrubbed, or redacted, to remove all personally identifying information (PII) on the file. Failure to do so will potentially allow an accidental or deliberate breach of the data, resulting in an FCC violation or potential lawsuit by injured parties. In addition to possible data disclosures due to a data breach, this could prove to be very embarrassing to the company and could possibly harm its reputation. Your tasks before release include the following:

As a data manager, you will explore these questions by first data masking (de-identifying) the Customer Survey dataset through two principal identifiers: Gender and Age. Then you are tasked with re-identifying the data and calculating the risk of exposure of each of the 4 basic scenarios listed early on in the project description above.

In order to fully answer these questions, you will need to go beyond this dataset and scenarios alone and examine this problem from a larger perspective. You will need to research historical risk data for this kind of data breach/attack activity in this industry, and during the course of your research, you will need to justify your calculations and decision to release the data based on the following questions.

1. Question 1: Before I mask my company's data, what legal, ethical, and security requirements do I have to fulfill in order to ensure a high degree of data confidentiality before these data can be prepared for sharing and released? Explain in detail and cite your work.
2. Question 2: What is the risk or likelihood of exposure of these data to the general population, or to a subset of this population, such as other employees others close to you?