To demonstrate this trade-off, we consider a small data set that gives the political party a person has voted for, as well as their name, age, gender. This is obviously private and sensitive information that needs to be protected. However, what is the best way to protect this sensitive data if we want to share it with a data scientist to investigate the relationship between gender, age and political leaning? 

 

 

 

 

 

 

First thing, we will mask the names which remove direct identifiers (ID). This, however, far from ensures privacy, as people can still easily be identified using a combination of quasi-identifiers (QID) such as age and gender. This is known as a linkage attack. More information on those here.

We will employ a further two privacy enhancing techniques (PETs) to increase privacy. Record suppression, which removes specific records at risk of identification, can increase privacy. This comes at the cost of the quantity of data. We can also use generalization to change specific ages to age ranges which can prevent attackers from identifying individuals but also serves to reduce data quality.

If we want to optimize something, we need to be able to measure and quantify outcomes. For the purposes of this demo, we are using k-anonymity as our privacy metric (you can find a more detailed explanation here). We will measure the utility in two ways for our two PETs (Local suppression and generalization). For local suppression, we can simply take the percentage of data removed as a proxy for loss of utility. When it comes to generalization, we can intuitively see that the larger the age range we generalize to (e.g. 2-year intervals vs 20-year intervals) the lower the accuracy of any analysis. Generalized information loss is a more formalized expression of this which we will use as our second measure of utility.