Anonymization Did Not Fail: Misconceptions and Overstatements on Data Anonymization Failures

In the digital age, the proliferation of data has given rise to unprecedented opportunities for analysis and insights, enabling significant advancements across various domains such as healthcare, finance, and social sciences. However, this wealth of data also poses substantial risks to individual privacy, leading to increasing concerns about data protection and the ethical implications of data usage. The challenge lies in balancing the need to protect personal data with the imperative to extract meaningful insights from it. Data privacy and anonymization have become critical focal points in this landscape, aiming to safeguard personal information while still allowing for its analytical utility. The proposed method for data privacy and anonymization focuses on optimizing the balance between protecting personal data and maintaining its utility for analysis. The approach leverages advanced anonymization techniques and rigorous data processing algorithms to achieve high accuracy and minimal errors in preserving privacy while enabling data analysis. The method's performance was evaluated using key metrics, demonstrating its effectiveness in real-world applications. The results indicated an accuracy rate of 94.8%, a Root Mean Squared Error (RMSE) of 0.208, and a Mean Absolute Error (MAE) of 0.406. These findings highlight the method's robustness in protecting personal data while still enabling comprehensive analysis and insights, addressing the critical challenge of balancing data privacy with analytical utility. This paper delves into the contemporary issues surrounding data privacy and anonymization, evaluating current methodologies and their effectiveness in protecting personal data while enabling valuable analysis. It further examines the regulatory landscape and the evolving threats to data privacy, offering insights into future directions for research and practice in this critical area.

Often microdata sets contain attributes which are neither numerical nor ordinal, but take nominal values from a taxonomy, ontology or classification (e.g. diagnosis in a medical data set about patients, economic activity in an economic data set, etc.). Such data sets must be anonymized if transferred outside the data collector's premises (e.g. hospital or national statistical office), say, for research purposes. The literature on microdata anonymization methods is relatively limited for nominal data. Multiple imputation is a usual choice for such data, but it has computational problems when nominal attributes can take many possible different values. In this paper, we provide anonymization methods for data sets which include nominal taxonomic attributes with many possible different values. We show how to adapt to the case of taxonomic attributes two anonymization methods, data shuffling and microaggregation, that were originally designed for numerical attributes. The above adaptation relies on a hierarchy-aware numerical mapping of nominal categories, which we call marginality. The resulting adapted methods circumvent the computational problems of multiple imputation and take the semantics of the taxonomy into account.

Cloud computing is completely about productivity, economy, and corporate agility. But there raises a question how we can commercially attain those benefits if their cloud management solution becomes inefficient, incomplete, and inflexible. Even though there are many aspects in cloud environment. The data security, confidentiality and privacy plays a major role in cloud deployment model. In case of private cloud the identity anonymization and secured data storage becomes essential to address. But we as developers of cloud can maintain the cloud with perfect methods and protocols which make the cloud service delivery more efficient, productive, and agile. In this paper a method for identity anonymization and secure data storage in private cloud using GDS (Group Digital Signature) is proposed and implemented.

In the era of big data, privacy preservation has been the focus for data mining. Mondrian anonymization is a state-of-the-art data anonymization algorithm for relational dataset, widely used in many classical syntactic privacy-preserving data mining methods, like k-anonymity, l-diversity, t-closeness, etc. Mondrian anonymization is named for its multidimensional data partitioning in geometric space to find the best partitions for data anonymization. However, one problem with using Mondrian anonymization is taking too much time and memory for the high-dimensional data. Another problem is that the Mondrian-based privacy preservation may lead to the unstable performance of data mining models. For example, in Mondrian-based k-anonymity, the accuracy results of data mining may drop dramatically with the growth of k value. For solving these problems, in this paper we propose an enhanced Mondrian anonymization model based on Self-Organizing Map (SOM-Mondrian). With the help of SOM, multidimensional data are converted from a high dimensional space into two-dimensional space; at the same time, preserving their topological properties of the input space. The resulting two-dimensional data are then used by Mondrian algorithm to find the best partitions for data anonymization. To our best knowledge, we are the first to propose SOM-based method for Mondrian anonymization. Experimental results show that, after applying our proposed method, the processing time of Mondrian anonymization decreases significantly from 12.11 seconds to 0.16 seconds; besides, the accuracy of data mining applications increases, about 2% higher than the results under the standard Mondrian anonymization, and also shows steadier and more robust (the degree of variation is reduced by 75%) to the varying k value.

Companies are looking to data anonymization research – including differential private and synthetic data methods – for simple and straightforward compliance solutions. But data anonymization has not taken off in practice because it is anything but simple to implement. For one, it requires making complex choices which are case dependent, such as the domain of the dataset to anonymize; the units to protect; the scope where the data protection should extend to; and the standard of protection. Each variation of these choices changes the very meaning, as well as the practical implications, of differential privacy (or of any other measure of data anonymization). Yet differential privacy is frequently being branded as the same privacy guarantee regardless of variations in these choices. Some data anonymization methods can be effective, but only when the insights required are much larger than the unit of protection. Given that businesses care about profitability, any solution must preserve the patterns between a firm’s data and that profitability. As a result, data anonymization solutions usually need to be bespoke and case-specific, which reduces their scalability. Companies should not expect easy wins, but rather recognize that anonymization is just one approach to data privacy with its own particular advantages and drawbacks, while the best strategies jointly leverage the full range of approaches to data privacy and security in combination.

Use of Public Participation Geographic Information System (PPGIS) for data collection has been significantly growing over the past few years in different areas of research and practice. With the growing amount of data, there is little doubt that a potentially wider community can benefit from open access to them. Additionally, open data add to the transparency of research and can be considered as an essential feature of science. However, data anonymization is a complex task and the unique characteristics of PPGIS add to this complexity. PPGIS data often include personal spatial and non-spatial information, which essentially require different approaches for anonymization. In this study, we first identify different privacy concerns and then develop a PPGIS data anonymization strategy to overcome them for an open PPGIS data. Specifically, this article introduces a context-sensitive spatial anonymization method to protect individual home locations while maintaining their spatial resolution for mapping purposes. Furthermore, this study empirically evaluates the effects of data anonymization on PPGIS data quality. The results indicate that a satisfactory level of anonymization can be reached using this approach. Moreover, the assessment results indicate that the environmental and home range measurements as well as their intercorrelations are not significantly biased by the anonymization. However, necessary analytical measures such as use of larger spatial units is recommendable when anonymized data is used. In this study, European data protection regulations were used as the legal guidelines. However, adaptation of methods employed in this study may be also relevant to other countries where comparable regulations exist. Although specifically targeted at PPGIS data, what is discussed in this paper can be applicable to other similar spatial datasets as well.

Many organizations, enterprises or public services collect and manage personal data of individuals. These data contain knowledge that is of substantial value for scientists and market experts, but carelessly disseminating them can lead to significant privacy breaches, as they might reveal financial, medical or other personal information. Several anonymization methods have been proposed to allow the privacy preserving sharing of datasets with personal information. Anonymization techniques provide a trade-off between the strength of the privacy guarantee and the quality of the anonymized dataset. In this work we focus on the anonymization of sets of values from continuous domains, e.g., numerical data, and we provide a method for protecting the anonymized data from attacks against identity disclosure. The main novelty of our approach is that instead of using a fixed, given generalization hierarchy, we let the anonymization algorithm decide how different values will be generalized. The benefit of our approach is twofold: a) we are able to generalize datasets without requiring an expert to define the hierarchy and b) we limit the information loss, since the proposed algorithm is able to limit the scope of the generalization. We provide a series of experiments that demonstrate the gains in terms of information quality of our algorithm compared to the state-of-the-art.KeywordsPrivacy-Preserving Data PublishingPrivacy k m-anonymityContinuous data

At present, most personalized privacy protection algorithms can be divided into two methods for protecting sensitive attributes. One is to set different thresholds for different sensitive attributes; the other is to generalize sensitive attributes, and replace the original sensitive attribute values with lowprecision generalized values. The anonymized data of the two methods has the risk of sensitive information leakage or large information loss, as well as the problem of data availability. To this end, a personalized (α, p, k) anonymous privacy protection algorithm is proposed. According to the sensitive level of the sensitive attribute, different anonymous methods are adopted for the sensitive values of each level in the equivalence class, so as to realize personalized privacy protection of the sensitive attribute. Experiments show that this algorithm has an approximate time cost and lower information loss than other personalized privacy protection algorithms.

Healthcare Information Systems typically fall into the group of systems in which the need of data sharing conflicts with the privacy. A myriad of these systems have to, however, constantly communicate among each other. One of the ways to address the dilemma between data sharing and privacy is to use data obfuscation by lowering data accuracy to guarantee patient’s privacy while retaining its usefulness. Even though many obfuscation methods are able to handle numerical values, the obfuscation of non-numerical values (e.g., textual information) is not as trivial, yet extremely important to preserve data utility along the process. In this paper, we preliminary investigate how to exploit ontologies to create obfuscation mechanism for releasing personal and electronic health records (PHR and EHR) to selected audiences with different degrees of obfuscation. Data minimisation and access control should be supported to enforce different actors, e.g., doctors, nurses and managers, will get access to no more information than needed for their tasks. Besides that, ontology-based obfuscation can also be used for the particular case of data anonymisation. In such case, the obfuscation has to comply with a specific criteria to provide anonymity, so that the data set could be safely released. This research contributes to: state the problems in the area; review related privacy and data protection legal requirements; discuss ontology-based obfuscation and anonymisation methods; and define relevant healthcare use cases. As a result, we present the early concept of our Ontology-based Data Sharing Service (O-DSS) that enforces patient’s privacy by means of obfuscation and anonymisation functions.

Healthcare is a rapidly evolving field. Such development creates opportunities to provide better quality, evidence-based treatment, however, increasing privacy violations. Anonymization can be applied to share data safely. This paper is a literature review of methods and tools for anonymization that includes 1930 papers, 32 of which were selected for the final evaluation. This article is an updated and extended version of the research conducted by our team in 2020 (Vovk 2021a). We found that despite the variety of methods, there is no single method that fits all cases. Certain methods are more widely used and create a background for advanced and secure methods. Our research shows that anonymization methods are used in tools for simplification and automation. Among challenges related to the use of all anonymization methods, is the proper balance between risk and data utility and highlight that the anonymization process is not limited to only technical measures but interdisciplinary.

Recently, data mining over transactional data streams has become an attractive research area. However, releasing raw transactional data streams, in which only explicit identifying information must be removed, may compromise individual privacy. Many privacy-preserving approaches have been proposed for publishing static transactional data. Due to the characteristics of data streams, which must be processed quickly, static data anonymization methods cannot be directly applied to data streams. In this paper, we first analyze the privacy problem in publishing transactional data streams based on a sliding window. Then, we present two dynamic algorithms with generalization and suppression to anonymize continuously a sliding window to make it satisfy $\rho $ -uncertainty by structuring an affected sensitive rules trie, because the removal and addition of transactions may make the current sliding window fail to satisfy $\rho $ -uncertainty. Experimental results show that our methods are more efficient than sliding window anonymization with batch processing by using existing static anonymization methods.

Data anonymization methods are currently implemented in 5G-New Radio technical standards that help facilitate performance requirements while affording users with a certain expectation of privacy. This paper presents an efficient approach to negating current anonymization methods in a computationally efficient manner. The approach is achieved through manipulation of the polar coding process, allowing for the identification of syndromes in the decoded bits. These syndromes allow for the determination of the message recipient’s address. The ideas presented here will help to inform the development of future technical standards in ensuring robust data privacy. Simulations were conducted that develop a relationship between successful decoding rate as a function of signal-to-noise ratio levels and number of receiver antennas, as well as techniques to further develop the efficiency of the methodology while limiting false positive results.

Complex data, which has single-valued attributes and set-Valued attributes, enables us to associate these attribute values and analyze these relationships. Before releasing such complex data, ensuring anonymity for these data owners should be required. However, existing data anonymization methods are not work well because they only assume that quasi-identifiers are either multidimensional single-valued attributes or one set-value attribute. This paper proposes an anonymization method which integrates recodings for single-valued attributes and set-valued attributes into a whole top-down anonymization. Especially, in order to integrate recoding for set-valued attributes, this paper also proposes top-down itemset recoding which follows top-down manner and does not obfuscate items to ensure k-anonymity. In the experiment part, using real dataset, we clarify characteristics and effectiveness of proposed method. This method does not require the generalization hierarchy for set-valued attributes, thus the anonymized itemsets are not obfuscated and can be analyzed by standard data mining tools.

Location information, such as customers’ home addresses, is essential for data mining tasks. On the other hand, it is sensitive private information. In most countries, when requesting a third party for data mining, it is legally required to anonymize personal information such as home addresses in the database. However, conventional anonymization methods significantly lose the usefulness that location information has inherently. In this paper, we proposed an anonymization method of location retaining important locational features. In the proposed method, each address is replaced with a ranking value of the distance from each facility that is important in terms of location, such as a station or a supermarket. We examined our method and confirmed that the important rules mined from non-anonymized data could also be mined from our anonymized data.KeywordsDatabase anonymizationAddressLocationDatabase utilizationPrivacy preserving data mining

Rapid development of web 2.0 and social networks brings convenience for users' information sharing. The thriving of information sharing inevitably leaves users' private information vulnerable to leakage. Weighted social networks can provide more personal information than unweighted social networks, such as those weight based information. Weight based information (weight distribution, shortest paths etc.) can be not only the objects needing preserving but also clues grasped by adversaries to initiate identity re-identification. Most of current work however overlooks this kind of privacy leakage incurred by adversaries' grasping of some weight distribution information. In this paper, we propose a Hellinger distance based privacy model (k, λ)-similarity to surmount the problem of sensitive identity re-identification leveraging background knowledge of weight distribution. Particularly, a sliding window and binary approximation based data perturbation algorithm SWBADP is devised to realize (k, λ)-similarity privacy constraint. Further, concerning the potential privacy leakage originated from merely k-degree anonymous, an optimization criterion, called depth clustering, is discussed to address the problem. The empirical studies demonstrate our implementation delivers both well defense capability to sensitive identity re-identification and better weight based data utility.