Latanya Sweeney

1 card

1. 01

   Lesson 20 · No name does not mean anonymous: postcode, date of birth and sex identify most people.

   k-anonymity: a model for protecting privacy · 2002

   A quasi-identifier is harmless alone; three together are a name.

   Sweeney showed, with real "anonymised" hospital data and a purchased voter list, that three mundane columns — postcode, date of birth and sex — are unique for most of the population. These columns are quasi-identifiers: each is harmless alone, together they are a name. k-anonymity is her answer: a release is safe only if every combination of quasi-identifiers appears for at least k people. It is achieved through generalisation (date of birth becomes a year or an age band, postcode becomes a county) and suppression (rows too rare are removed). That is not the end of the story. If all k people in a group share the same diagnosis, you still learned something about each — hence l-diversity and t-closeness, which demand variety in the sensitive attribute. And any "anonymous" set can be linked to another set published tomorrow. For the warehouse, the practical rule: an extract without names is not anonymous until you have counted its quasi-identifiers and checked k on every combination; and aggregation is your friend — a report by age band and county has no person rows at all.

   “A release provides k-anonymity protection if the information for each person contained in the release cannot be distinguished from at least k-1 individuals whose information also appears in the release.”

   Open the card →