Abstract

Today’s globally networked society places great demand on the dissemination and sharing of information. While in the past released information was mostly in tabular and statistical form, many situations call today for the release of specific data (microdata). In order to protect the anonymity of the entities (called respondents) to which information refers, data holders often remove or encrypt explicit identifiers such as names, addresses, and phone numbers. De-identifying data, however, provides no guarantee of anonymity. Released information often contains other data, such as race, birth date, sex, and ZIP code, that can be linked to publicly available information to re-identify respondents and inferring information that was not intended for disclosure. In this paper we address the problem of releasing microdata while safeguarding the anonymity of the respondents to which the data refer. The approach is based on the definition of k-anonymity. A table provides k-anonymity if attempts to link explicitly identifying information to its content map the information to at least k entities. We illustrate how k-anonymity can be provided without compromising the integrity (or truthfulness) of the information released by using generalization and suppression techniques. We introduce the concept of minimal generalization that captures the property of the release process not to distort the data more than needed to achieve k-anonymity, and present an algorithm for the computation of such a generalization. We also discuss possible preference policies to choose among different minimal generalizations. Index terms:

Citations

909	Introduction to Lattices and Order - Davey, Priestley - 1990
462	Cryptographyand Data Security - Denning - 1982
264	Security-control methods for statistical databases: a comparative study - Adam, Worthmann - 1989
160	Protecting privacy when disclosing information: k-anonymity and its enforcement through generalization and suppression - Samarati, Sweeney - 1998
87	A Security Policy Model for Clinical Information Systems - Anderson - 1996
63	Suppression methodology and statistical disclosure control - Cox - 1980
62	Guaranteeing anonymity when sharing medical data, the Datafly System - Sweeney
41	Weaving technology and policy together to maintain confidentiality - Sweeney - 1997
32	Finding a needle in a haystack or identifying anonymous census records - Dalenius - 1986
32	Detection and elimination of inference channels in multilevel relational databases - Qian, Stickel, et al. - 1993
26	Aggregation and inference: Facts and fallacies - Lunt - 1989
25	Inference problems in multilevel secure database management systems - Jajodia, Meadows - 1995
22	µ- and τ-Argus: Software for statistical disclosure control - Hundepool, Willenborg - 1996
7	The computer-based patient record confidentiality - Woodward - 1995
4	Information privacy issues for the 1990s - Turn - 1990
1	Pierangela Samarati, and Bhavani Thuraisingham. Privacy issues in www and data mining - Dobson, Jajodia, et al. - 1998
1	de Wolf, editors. Private Lives and Public Policies. National Academy - Duncan, Jabine, et al. - 1993