Anonymisation techniques and differential privacy
Why k-anonymity, l-diversity and t-closeness exist, how linkage attacks re-identify people anyway, and how differential privacy gives a mathematical guarantee with epsilon, sensitivity and a privacy budget.
01Re-identification by linkage
- Explain quasi-identifiers and how linkage attacks re-identify removed names
- Apply k-anonymity with generalisation and suppression, and spot its failures
- Explain what l-diversity and t-closeness add
- Define differential privacy in terms of epsilon and neighbouring datasets
- Work a Laplace mechanism example with sensitivity and a privacy budget
Removing names and IDs does not anonymise a dataset. The remaining columns, such as postcode, birth date, gender and job title, are quasi-identifiers: individually harmless, jointly unique. An attacker joins them against a public or leaked dataset that does have names. This is a linkage attack.
| Case | What was released | How it was re-identified |
|---|---|---|
| Massachusetts GIC (1997) | Hospital records without names, with ZIP, birth date, sex | Latanya Sweeney bought the voter roll and found the governor's record; she later estimated ZIP, birth date and sex alone single out most Americans |
| AOL search logs (2006) | 20 million queries with random user numbers | Journalists identified users from the content of their own searches |
| Netflix Prize (2008) | Movie ratings with dates, no names | Narayanan and Shmatikov matched a handful of ratings and dates to public IMDb reviews |
The lesson is that any attribute can be a quasi-identifier given the right auxiliary data, and that high-dimensional data (ratings, locations, purchases) is almost always unique. Location traces are a classic: a few points of time and place are usually enough to single out one person in millions.
If asked "how would you anonymise this dataset", do not start with "remove the names". Start with "what will be released, to whom, with what auxiliary data available", then say whether aggregates with differential privacy would meet the need instead of row-level data.
This is an advanced module
Privacy engineering is part of the Pro pass. 3 more sections — the deep dives, the final design, follow-ups and the test — unlock with it.
Already a cyart.io or studio.cyart.io member? Your pass code is in your Studio account.