Define, Assess, Decide
We will place ourselves in the following context:
Workshop Overall Problem Statement
How can statistical information be disseminated without harming the individuals or organizations from whom the information was collected?
The missions [of official statistics] do not depend solely on its ability to master the tools or methods necessary for producing quality information, but also on its ability to protect and guarantee the confidentiality of the data entrusted to it. This protection is the condition for continuing to have access to this data. (Redor 2023)
A maximalist definition of disclosure…
T. Dalenius proposes in 1977 the following definition:
“If the publication of the statistics \(T(D)\) allows determining the value of confidential statistical data more precisely than would be possible without access to \(T(D)\), then a disclosure has occurred.” (Dalenius 1977).
… impossible to hold
This definition does not take into account the auxiliary information already available
An example of disclosure impossible to protect
Studies show a correlation between smoking and the occurrence of lung cancer \(\Rightarrow\) if, we (an insurance company) know that an individual is a smoker, then we can attribute to them a significant risk of having cancer, information which will very likely cause harm to that person.
Two realities must be taken into account:
\(\Rightarrow\) unconditional and total protection is not possible.
Data protection is defined through:
\(\Rightarrow\) Need to arbitrate between the two components.
Protecting confidential data means arbitrating between:
their utility for knowledge and public debate;
their intrinsic risk: any data disseminated can disclose information about an individual or a group of individuals.
Not disseminating would make the public statistic useless.
Disseminating everything would make the public statistic dangerous.
\(\Rightarrow\) How to address them without too much deteriorating the statistical information?
Finding a balance between protection and information
This involves achieving a compromise between minimizing the risks of disclosing confidential information and minimizing the loss of information due to data protection processes.
No Magic Method
There is no method that minimizes risk and information loss at the same time!
The population census (RP) in France:
Specific publication decree;
Utility of RP data is very strong:
Risk of using disseminated data against individuals is judged low:
INSEE disseminates municipal data even for very small municipalities:
See the example of the municipality of Rochefourchat:
There is no such thing as zero risk
No method completely eliminates risk \(\Rightarrow\)
Trade-offs are therefore inherent to data protection.
This trade-off is considered the paradigm of the discipline.
(Voir Cox et al. 2011)
If it helps to know how to think…
…it helps less to know how to act.
A Costs/Benefits trade-off is performed:
\(\Longrightarrow\) Implement methods that have a cost adapted to the identified risk and to the sensitivity of the data.
To arbitrate, one must be able to
Define the terms of the arbitration
Measure the phenomena.
Before defining the risks:
Objective
To better manage risks, become aware of the context in which they are likely to appear.
Four main types of users can be distinguished:
The looser the access, the higher the anonymization must be able to be:
The looser the access, the higher the anonymization must be able to be:
The looser the access, the higher the anonymization must be able to be:
A necessary accountability:
Is it necessary to protect the data?
What are the main characteristics and uses of the data?
Definition and measurement of disclosure risks
Selection of data protection methods
Implementation of the methods
Controls and documentation
Source: (Hundepool et al. 2024)
Analysis of the units considered and variables present in the microdata file; if they are not sensitive, there is no need to perform processing for data protection
What type of dissemination? (data tables, maps, microdata ...)
Analysis of the type and structure of the data to determine the variables / units that require protection
Analysis of the survey methodology
Definition of the institute’s objectives: type of publication (PUF, MFR), dissemination policies, consistency between multiple simultaneous disseminations, consistency with what is already published
Analysis of user needs (priority variables, types of analyses that will be performed)
Analysis of the questionnaire for surveys (variables to remove / to include, what level of detail for structural indicators such as socio-demographic variables?)
Identify the different possible scenarios leading to data disclosure
Choose the disclosure risk measure(s)
Risk tolerance threshold to set
Choose one / several protection method(s)
Compare the methods: risk level vs loss of utility
Choose software
Perform the measurement of disclosure risks
Protect the data
Quantification of information loss
Process protection control
Preparation of a document summarizing the methods used and providing an overview of the information loss
General Definition
Risk of disclosing confidential information by publishing aggregated or individual data.
Identity disclosure risk
Attribute disclosure risk
Disclosure risk by inference
Disclosure risk by differentiation
by “nesting”
by “cross-referencing”
Definition
Risk of recognizing a specific individual in the published data: an attacker can identify a unit from the publication.
Examples:
Certain variables such as name, address that identify directly individuals or households.
All people with very rare characteristics (e.g., very elderly people).
87% of the U.S. population is unique solely from ZIP code, gender, and date of birth (Sweeney 2000).
Direct identifiers (name, first name, address) are useful for collection but removed from statistical databases.
Other variables have a strong re-identifying power (place of residence, age, gender, profession, education level, etc.).
Re-identifying does not always allow obtaining more information about people.
Definition
Risk of disclosing sensitive information about one or more individuals from the disseminated data.
Examples:
| Femmes | Hommes | |
|---|---|---|
| Diabétiques | 30 | 40 |
| Non diabétiques | 12 | 0 |
Definition
Risk of being able to deduce with high certainty sensitive information about individuals from published data.
| Women | Men | |
|---|---|---|
| Diabetic | 30 | 38 |
| Non-diabetic | 12 | 2 |
Definition
When aggregated information is disseminated for various cross-tabulations, it is sometimes possible to infer additional information by differentiating the various results.
Examples:
In an individual dataset, we distinguish:
Identifiers: Variables that allow direct identification of an individual.
Quasi-identifiers: Variables that can lead to re-identifying an individual using auxiliary information.
Sensitive variables: Variables for which specific protection measures may be necessary.
Other variables
Identifiers are removed very early in the production process to comply with data protection regulations.
Thereafter, it will be assumed that all direct identifiers have been removed.
For individual/household data: sex, age, place of residence, diploma, marital status, etc.
For company data: sector of activity, location of headquarters, etc.
List to be determined each time
What variables does an attacker already have?
Identifiants
|
Quasi Id.
|
Sensible
|
|||
|---|---|---|---|---|---|
| Nom | Adresse | Commune | Age | Diplôme | Revenus |
| Johan | 3 rue... | Paris | 36 | Bac | 150000 |
| Jeanne | 11 bd... | Malakoff | 41 | Bac+3 | 60000 |
| Johnny | 12 pl... | Pithiviers | 23 | Bac Pro | 25000 |
| Jeannette | 8 rue... | Belval | 85 | 10000 | |
\(k\)-Anonymity (Sweeney 2002)
A dataset is considered k-anonymous if the least frequent combination of modalities of the quasi-identifying variables includes at least k units.
This measure ensures that all individuals are similar to at least \(k-1\) others.
Overall risk measure that focuses on the individuals most at risk of re-identification.
The probability associated with the risk for an individual in the file of being re-identified is at minimum \(1/k\)
Choice of \(k\) taking into account existing rules and/or risk-utility trade-offs.
Important
The YAML, code block syntax, and callout structure have been preserved exactly as in the original French version.
k-anonymity protects data from a re-identification attack when the attacker has auxiliary information about the same individuals (at least one):
An effectiveness that depends on the realism of the scenario
Ensuring a certain level of anonymity helps reduce the risk of re-identification, but:
| Id | Age | Gender | Disease |
|---|---|---|---|
| 1 | [45;55[ M | Diabetes | |
| 2 | [45;55[ M | Arterial hypertension | |
| 3 | [45;55[ F | Cancer | |
| 4 | [45;55[ F | Flu | |
| 5 | [70;75[ M | Diabetes | |
| 6 | [45;55[ M | Diabetes |
The l-diversity (Machanavajjhala et al. 2007)
It ensures sufficient diversity of the values of a sensitive variable taken by individuals within the same combination of quasi-identifiers.
Refinement of \(k\)-anonymity.
Protection against the disclosure of sensitive attributes.
Each group must contain at least \(l\) different values of the studied sensitive variable (or \(l\) of the most frequent values).
Choice of the target \(l\) based on existing rules and/or a risk-utility trade-off.
| Age | Sex | Disease |
|---|---|---|
| [50;55[ | M | Diabetes |
| [50;55[ | M | Diabetes |
| [50;55[ | F | Cancer |
| [50;55[ | F | Flu |
| [50;55[ | M | Diabetes |
\(\Rightarrow\) If a comprehensive file is \(k\)-anonymous, then \(\forall c, N_c \geq k\).
Unique in the population: \(N_c = 1\)
Unique in the sample: \(n_c = 1\)
Unique in the sample who are also unique in the population: \(n_c = 1\) et \(\sum\limits_{i \in c}{w_i} = 1\)
k-anonymity and l-diversity are global measures.
We can move to the individual level:
\[r_c = \frac{1}{N_c}\]
Probability of re-identifying an individual in a sample
At the sample level: \[r_c = \frac{1}{n_c}\]
At the population level, the re-identification risk can be estimated by:
\[\hat r_c = \frac{1}{\sum\limits_{i \in c}{w_i}}\]
where \(\sum\limits_{i \in c}{w_i}\) is an estimate of \(\hat N_c\).
To perform the arbitrage, a global risk measure is more practical. One can consider:
More refined measures are implemented in classic tools such as \(\mu\)-Argus or the R package sdcMicro.
When a sample is available (thus the \(n_k\)), the \(N_k\) are generally unknown.
Measure of individual risk conditional on the sample: \(r_k = \mathbb{E}(\frac{1}{N_k}|n_k)\).
Measure depending on a modeling of the (posterior) distribution of \(N_k | n_k\)
Modeling of key frequencies in the population conditional on their frequency in the sample.
By a negative binomial, for example, in Benedetti and Franconi (1998).
A posteriori measure of the distance between individuals in the protected dataset and those in the original dataset.
Allows evaluating the number of exact matches between perturbed data and original data.
High risk of re-identification of individuals with values in the tail of the distribution (e.g., very high incomes of footballers)
A perturbation is not always sufficient (A perturbed outlier often remains an outlier).
Detection of outliers based on the quantiles of the distribution.
Attack Scenario
Defining attack scenarios involves considering the means used by the attacker and objectifying the fraudulent uses that we seek to prevent.
Cost/Risk Trade-off (INS)
Cost/Benefit Trade-off (Attacker)
Cohen (2022)
There are many ways to evaluate information loss.
Strongly linked to the level of protection.
Many methods to evaluate information loss; the choice of measure depends entirely on the end users of the published data.
Difficult to anticipate all uses of a dataset and therefore all associated measures of information loss.
Need to make trade-offs on certain characteristics of a table to relax constraints elsewhere.
It is impossible to preserve all characteristics of a dataset.
Disclosure risks
