Releasing Individually Identifiable Microdata with Privacy Protection Against Stochastic Threat

20 Pages·2007·0.35 MB·English

Information Systems Research informs
®
Vol.18,No.1,March2007,pp.23–41
doi10.1287/isre.1070.0112
issn1047-7047(cid:1)eissn1526-5536(cid:1)07(cid:1)1801(cid:1)0023
©2007INFORMS
Releasing Individually Identifiable Microdata with
Privacy Protection Against Stochastic Threat:
An Application to Health Information
Robert Garfinkel, Ram Gopal, Steven Thompson
DepartmentofOperationsandInformationManagement,SchoolofBusiness,
UniversityofConnecticut,Storrs,Connecticut06029
{rob.garfi[email protected],[email protected],[email protected]}
T
heabilitytocollectanddisseminateindividuallyidentifiablemicrodataisbecomingincreasinglyimportant
in a number of arenas. This is especially true in health care and national security, where this data is con-
sidered vital for a number of public health and safety initiatives. In some cases legislation has been used to
establish some standards for limiting the collection of and access to such data. However, all such legislative
effortscontainmanyprovisionsthatallowforaccesstoindividuallyidentifiablemicrodatawithouttheconsent
ofthedatasubject.Furthermore,althoughlegislationisusefulinthatpenaltiesareleviedforviolatingthelaw,
these penalties occur after an individual’s privacy has been compromised. Such deterrent measures can only
serve as disincentives and offer no true protection. This paper considers security issues involved in releasing
microdata,includingindividualidentifiers.Thethreatstotheconfidentialityofthedatasubjectscomefromthe
users possessing statistical information that relates the revealed microdata to suppressed confidential informa-
tion. The general strategy is to recode the initial data, in which some subjects are “safe” and some are at risk,
intoadatasetinwhichnosubjectsareatrisk.Wedevelopatechniquethatenablesthereleaseofindividually
identifiable microdata in a manner that maximizes the utility of the released data while providing preventive
protectionofconfidentialdata.Extensivecomputationalresultsshowthattheproposedmethodispracticaland
viableandthatusefuldatacanbereleasedevenwhenthelevelofriskinthedataishigh.
Keywords: datasecurity;privacy;healthinformation;optimization
History: Sumit Sarkar, Senior Editor; Ramayya Krishnan, Associate Editor. This paper was received on
February28,2005,andwaswiththeauthors6monthsfor2revisions.
1. Introduction or financial information, a number of laws have been
As information storage and processing capabilities passed that address the question of when IIM can
increase, a number of groups and organizations be collected and shared. Examples at the federal
are engaging in the collection and dissemination of level include the Privacy Act of 1974, the Computer
individually identifiable microdata (IIM). Examples Matching and Privacy Protection Act of 1988, the
include the Department of Homeland Security, the Paperwork Reduction Act of 1995, the Principles for
Centers for Disease Control and Prevention, insur- Providing and Using Personal Information (“Privacy
ance companies, and various state and local public Principles”), published by the Information Infrastruc-
health departments. In some cases IIM are collected ture Task Force in 1995, and the Health Insurance
and used by a specific organization. In other cases Portability and Accountability Act (HIPAA), enacted
data is collected and shared with other organizations. in 1996. In most cases these laws provide substantial
The collection and dissemination of IIM is typically disincentives for the abuse of IIM. For instance, the
considered justifiable when the objectives of the data maximumpenaltyunderHIPAAfortheabuseofper-
recipientaredeemedtobe“forthegreatergood”and sonal health information is a $250,000 fine and up to
statistical data alone is not sufficient to achieve those 10 years imprisonment.
objectives. Nevertheless, although enacted for the purpose of
In recognition of the fact that IIM is highly sensi- protectingindividualprivacyinthefaceofanincreas-
tive, especially in relation to matters such as medical ingly computerized world, all these laws contain
23
Garfinkel,Gopal,andThompson: PrivacyProtectionforIndividuallyIdentifiableMicrodata
24 InformationSystemsResearch18(1),pp.23–41,©2007INFORMS
provisions that allow for the collection and dissem- Figure1 CategorizationofDataSetAttributes
ination of IIM. The HIPAA Privacy Rule provides a
good example of such provisions as related to medi- Identity-related Confidentiality-related Confidential
attributes attributes attributes
cal information. The following summary, taken from
the CDC website (2005) describes the current situa-
tion well:
Blood type, Salary,
New national health information privacy standards SS# Gender, ZIP
years of education diagnosis
have been issued by the U.S. Department of Health
and Human Services (DHHS), pursuant to the Health
the confidential information on any of the subjects
Insurance Portability and Accountability Act of 1996
is not divulged to the data users. Identity-related
(HIPAA). The new regulations provide protection for
attributesarethosethatcandirectlyorindirectlyhelp
the privacy of certain individually identifiable health
data,referredtoasprotectedhealthinformation(cid:1)PHI(cid:2). a user identify an individual or subject in the data
Balancing the protection of individual health informa- set. These may be such powerful indicators as name
tionwiththeneedtoprotectpublichealth,thePrivacy or social security number, or much weaker ones such
Rule expressly permits disclosures without individual
as profession or city of domicile. Confidentiality-
authorization to public health authorities authorized
related attributes are not confidential in and of them-
by law to collect or receive the information for the
selves but are statistically related to the confidential
purposeofpreventingorcontrollingdisease,injury,or
disability, including but not limited to public health attributes. Information on these attributes may allow
surveillance,investigation,andintervention. a user to estimate confidential values even if they
have been suppressed.
Legal protective measures that contain these types
Thecategorizationofidentity-relatedandconfiden-
of provisions can be problematic for at least two rea-
tiality-related attributes may not be mutually exclu-
sons. First, there is often ambiguity regarding what
sive. For instance, identity-related attributes such as
qualifiesagivensituationasbeing“exempt”fromthe
gender and age may also exhibit statistically signif-
law. The result is that in some cases IIM is “unjus-
icant relationships with a confidential attribute such
tifiably” collected and disseminated and in others a
as a particular medical condition.
given initiative might be incorrectly cancelled under
It is common to release “de-identified” data in for-
the mistaken belief that the collection and dissemina-
mats that are useful for statistical users. This can be
tion of IIM is not justified.
achieved in any number of ways, as indicated in the
The second concern is that legal protection ulti-
literaturereviewofthenextsection.Hereweconsider
mately takes the form of a deterrent measure and
how to release data in a safe and useful manner for
the data—and therefore the data subjects—are essen-
“IIM users.” By their nature these released data will
tially unprotected. That is, under existing law, if IIM
beconsistentwithanydatareleasedforstatisticalpur-
is abused and if this abuse is detected and if the
poses. Also there is no need to make any distinction
abusecanbeascribedtocertainindividualsinacourt between a “data snooper” and a “legitimate” user.
of law, then the perpetrators will be punished. This We assume that the subjects of the database desire to
may come as small consolation to data subjects who have their confidential information protected against
may have suffered loss of employment or employ- any and all users.
ment opportunities, cancelled insurance policies, or When considering the release of IIM that contain a
public embarrassment as a result of the unlawful use confidential attribute, one obvious approach to pro-
of IIM. tecting the confidentiality of the data subjects would
Confidentiality considerations typically center be to simply remove the confidential attribute from
around three categories of attributes, as described the released data. This is an important step, but it is
in Figure 1. Confidential attributes (e.g., salary or not sufficient because it is possible to infer the confi-
medical diagnosis) are sensitive information of the dential field value based on statistical data that relate
respondents or subjects in the data set. A central the released confidentiality-related field values to the
responsibility of the data provider is to ensure that confidential field value.
Garfinkel,Gopal,andThompson: PrivacyProtectionforIndividuallyIdentifiableMicrodata
InformationSystemsResearch18(1),pp.23–41,©2007INFORMS 25
The objective of this research is to develop a Datafly (Sweeney 2002a), have also been developed
method that allows the release of IIM while minimiz- to enable safe dissemination of data products. The
ing information loss and, at the same time, providing increased use of data-mining tools also presents a set
a degree of preventive confidentiality protection to of unique confidentiality problems that the academic
thedatasubjects.Itisimportanttonotethatthistech- literature has begun to address (Li and Sarkar 2006a,
nique is not meant to be a replacement for existing b; Menon et al. 2005).
legalmeasures.Rather,itisasupplementdesignedto In all this work, the threat to confidentiality gen-
offeradegreeofpreventiveprotectionforconfidential erally comes down to the identity disclosure prob-
information that is not currently available. lem, i.e., whether the user can positively link the
Theremainderofthepaperisorganizedasfollows. identity of an individual with a set of variable val-
Section 2 contains a review of related literature. Sec- ues (Dobra et al. 2003). A standard precaution is
tion 3 provides a conceptual overview of the model to sanitize the data by eliminating attributes that
and solution technique and introduces a motivating directly lead to the identity of the data subjects
example. Decision variables and various stochastic (e.g., name or social security number). The resulting
measures are introduced in §4, and §5 is devoted to data set is presented in a format that enables the
users to obtain statistical information on the remain-
precise definitions of risk. Section 6 contains the lin-
ing attributes, but prevents a user from associating
ear programming model, and §7 discusses the exten-
confidential data with subjects. Recent research has
sive computational results, as well as implementation
exploredtheriskofidentitydisclosureinthereleased
issues and managerial implications. Conclusions and
data set that may persist even after the elimina-
future research are presented in §8.
tion of attributes that directly lead to the identity of
datasubjects.Thefundamentalissueaddressedinthe
2. Related Literature
k-anonymity problem is the generation of data sets in
The information systems literature contains a con-
whicheachsubjectisindistinguishablefromnofewer
siderable amount of research in the general vein of
than k other subjects (Domingo-Ferrer and Mateo-
information security and confidentiality protection. A
Sanz 2002, Sweeney 2002b). The k-anonymity prob-
great deal of research effort has been dedicated to
lem has been shown to be NP-hard (Meyerson and
the problem of maximizing the amount and the util-
Williams 2004), and fast techniques that yield good,
ity of data that can be released without jeopardiz-
but not necessarily optimal, solutions have been the
ing the individual’s right to privacy (see, e.g., Adam
subject of a great deal of research (Aggarwal 2005,
and Wortman 1989, Chowdhury et al. 1999, Gopal
Aggarwaletal.2005,Domingo-FerrerandTora2005).
et al. 1998, Garfinkel et al. 2002, Muralidhar et al.
Work on k-anonymity has also been applied to more
1995). A number of techniques have been developed
specific problem settings such as locational privacy
to address the problem of maximizing information (Gedik and Liu 2005), distributed databases (Jiang
provision while ensuring that the revealed informa- and Clifton 2005), and facial derecognition (Newton
tion does not permit a user to infer confidential data et al. 2005).
about any individual subject. Suppression of cells in Regardless of the application area, the fundamen-
the tables to be released is a common strategy (Cox tal problem is the same, preventing the reidentifica-
1980, Carvalho et al. 1994, Causey et al. 1985, Duncan tion of a subject to within k records. The techniques
et al. 2003a, Fischetti and Salazar 2001, Kelly 1990, developedinthispaperdifferfrompriorworkinthat
Geurts 1992, Zayatz 1992, Cox 1992). Other meth- thereleaseddatasetexplicitlyincludestheidentityof
odsincluderowandcolumnaggregation(Willenborg the data subjects. We extend the general philosophy
and Hundepool 1998), data perturbation (Muralidhar of prior research, that of transforming data prior to
et al. 1995, Duncan and Fienberg 1999, Sarathy and theirreleasetoprotectthedatasubjects,tothedomain
Muralidhar 2002), and camouflage (Gopal et al. 1998, of IIM. In this setting the “R-U confidentiality map”
Garfinkel et al. 2002). (Duncan et al. 2003b) is adopted as a framework for
A number of software products, including (cid:3) and capturing the fundamental trade-off between mitigat-
(cid:4)-Argus (Hundepool and Willenborg 1996) and ing risk and the utility of the released data.
Garfinkel,Gopal,andThompson: PrivacyProtectionforIndividuallyIdentifiableMicrodata
26 InformationSystemsResearch18(1),pp.23–41,©2007INFORMS
Table1 IndividuallyIdentifiableMicrodata and de-identified data is normally released to sat-
isfy the information needs of statistical users. This is
Postal C-Reactive Choles- Blood
Name code Gender protein terol pressure Glucose Diagnosis illustrated in Table 2, where all individual identifiers
are removed and aggregate information on the confi-
M.A. 06040 M H H H V {Diabetes,Heart,
MRSA} dential attributes, grouped by confidentiality-related
G.P. 06269 M H H H V {Diabetes,Heart} attribute values, is released. Such a table, if deemed
M.L. 14260 F H H H V {Diabetes,Heart}
safe by the data provider, will be released in our
W.F. 14260 M L H L N
R.H. 06040 F L H L N modelalongwiththeperturbeddatabasetobedevel-
F.J. 06269 M N N N N oped in the remainder of the paper.
M.G. 98195 F N N N N Heart
We define an input channel as a combination of
J.M. 98195 F N N N N
A.B. 98195 F N N N N confidentiality-related attribute values for which con-
J.R. 14260 M N N N H Diabetes
fidential information is released. For example, C-Re-
R.S. 98195 M N N N H {Diabetes,Heart}
R.G. 90210 M L L L N active protein=H, cholesterol=H, blood pressure=
S.T. 23059 M L L L N H, glucose = V, would be represented as the input
J.T. 23059 F N N V N Heart
channel (cid:6)H(cid:7)H(cid:7)H(cid:7)V(cid:8).
M.D. 44187 F N N V N
The information in Table 2 enables users to iden-
tify trends and high-risk groups. For example, from
3. Recoding Individually Identifiable
Table 2 it is possible to determine that those with
Microdata: Conceptual Overview
high levels of C-Reactive protein, cholesterol, and
The technique described in this paper can be thought blood pressure as well as very high serum glucose
of as a special type of recoding (e.g., (cid:3)-Argus, levels, i.e., the subjects described by input channel
see Hundepool and Willenborg 1996). In conven- (cid:6)H(cid:7)H(cid:7)H(cid:7)V(cid:8), are at greater risk for heart disease,
tional recoding the values of individual attributes are diabetes,andadangerousinfectioncalledmethicillin-
merged attribute by attribute. The method presented resistantStaphylococcusaureus(MRSA)thanthegen-
in this paper involves first grouping attribute values eral population (which in this illustration is quite
into sets, and then merging over these sets. To illus- small for the purpose of having a viable working
trate, consider the problem faced by a data provider example).
in possession of the individually identifiable med- The ability to determine that those particular sub-
ical data set depicted in Table 1. Table 1 contains jects are at high risk for those diseases is impor-
data according to the following abbreviations: gen- tant. However, the statistical information alone is not
der {Male (M), Female (F)}, C-reactive protein (CRP) enoughforpublichealthworkerswhomayalsowant
levels {Low (L), Normal (N), High (H)}, cholesterol to contact those subjects. For instance, a public health
{Low(L),Normal(N),High(H)},bloodpressure(BP) worker may want to notify those at risk for diabetes
{Low (L), Normal (N), High (H), Very High (V)}, and andheartdiseaseofnewdietaryguidelinesandinfor-
serum glucose (Gluc) levels {Normal (N), High (H), mation regarding how to identify and seek treatment
VeryHigh(V)}.Thefield“Diagnosis”isconsideredto for so-called “silent heart attacks” (a heart attack that
be the confidential field. The data depicted in Table 1
willbeusedasanillustrativeexamplethroughoutthe
Table2 StatisticalData
paper. Additional, more detailed application areas in
public health and data mining are provided in the Confiden- #{Diabetes,
tiality #Sub- #Diabetes #Heart #{Diabetes, Heart,
e-companion.1
related jects (%) (%) Heart}(%) MRSA}(%)
To ensure protection of confidential information
on the subjects represented in the data set, grouped H,H,H,V 3 0(0) 0(0) 2(67) 1(33)
L,H,L,N 2 0(0) 0(0) 0(0) 0(0)
N,N,N,N 4 0(0) 1(25) 0(0) 0(0)
N,N,N,H 2 1(50) 0(0) 1(50) 0(0)
1Thee-companiontothispaperisavailableontheInformationSys-
L,L,L,N 2 0(0) 0(0) 0(0) 0(0)
tems Research website at http://isr.pubs.informs.org/ecompanion.
N,N,V,N 2 0(0) 1(50) 0(0) 0(0)
html.
Garfinkel,Gopal,andThompson: PrivacyProtectionforIndividuallyIdentifiableMicrodata
InformationSystemsResearch18(1),pp.23–41,©2007INFORMS 27
is not accompanied by symptoms such as chest pain input channels. It contains as much information as is
and difficulty breathing), which afflict diabetics more safely possible to reveal on the confidentiality-related
commonly than the general population. In this case fields. Table 3 illustrates, in essence, the format of the
the public health worker would want those at risk to released IIM.
understandtheriskfactorsforsilentheartattacksand
advise them to be screened by a physician for silent 3.1. Mapping from Input Channels to
ischemia,whichisaprecursortoasilentheartattack. Output Channels
Likewise, the ability to identify and contact those at Figure 2 provides an input channel-based represen-
risk for MRSA represents an important public health tation of the information in Table 1. Releasing the
initiative. information as shown in Figure 2 is equivalent to
In this work we show that this can be achieved “full revelation,” in the sense that the data recipi-
while protecting the confidential information of the entknowsexactlywhichinputchanneldescribeseach
subjects.Theinformationutilitymeasure,correspond- subject.
ing to that of Duncan et al. (2003b), is inversely pro- Even though confidential information is not in-
portional to the number of spurious subjects who cluded explicitly here, it would be simple for a user
couldpotentiallybecontactedandtoldthattheymay to stochastically infer confidential information about
beatrisk.Suchsubjectsshouldeasilybeabletoverify the subjects described by a given input channel. This
that the warning does not pertain to them. is illustrated in Figure 2, which shows, for each input
The application of the technique proposed here re- channel, the percentage of subjects that have a partic-
sults in a modified version of the original microdata ulardisease.Anextremesolutionwouldbetoprotect
setwiththeindividualidentifiersintactandtheconfi- thesubjectsbyassigningallofthemtoasingleoutput
dentialattributesremoved.Further,itisbasedonout- channel that contained, as its elements, all six input
put channels, which are defined as sets of one or more channels. Figure 3 illustrates the result.
Table3 IndividuallyIdentifiableMicrodataFormat
C-Reactive Blood
Name ZIP Gender protein Cholesterol pressure Glucose Diagnosis
M. A. 06040 M
G. P. 06269 M
M. L. 14260 F
W. F. 14260 M
R. H. 06040 F
F. J. 06269 M
M. G. 98195 F As m
JA.. MB.. 9988119955 FF uch as possi Removed
bl
e
J. R. 14260 M
R. S. 98195 M
R. G. 90210 M
S. T. 23059 M
J. T. 23059 F
M. D. 44187 F
Garfinkel,Gopal,andThompson: PrivacyProtectionforIndividuallyIdentifiableMicrodata
28 InformationSystemsResearch18(1),pp.23–41,©2007INFORMS
Figure2 FullRevelation
Diabetes 0%
Heart 0% Input channel 1 M. A.
Diabetes, Heart 67% (H,H,H,V)
G. P.
Diabetes, Heart, MRSA 33%
M. L.
Diabetes 0%
Heart 0% Input channel 2 W. F.
Diabetes, Heart 0% (L,H,L,N)
R. H.
Diabetes, Heart, MRSA 0%
F. J.
Diabetes 0%
M. G.
Heart 25%
Input channel 3
Diabetes, Heart 0% (N,N,N,N) J. M.
Diabetes, Heart, MRSA 0% A. B.
Diabetes 50%
Heart 0%
Input channel 4 J. R.
Diabetes, Heart 50% (N,N,N,H)
R. S.
Diabetes, Heart, MRSA 0%
Diabetes 0%
Heart 0%
Input channel 5 R. G.
Diabetes, Heart 0% (L,L,L,N)
S. T.
Diabetes, Heart, MRSA 0%
Diabetes 0%
J. T.
Heart 50% Input channel 6
(N,N,V,N) M. D.
Diabetes, Heart 0%
Diabetes, Heart, MRSA 0%
By assigning all subjects to an output channel com- any individual. Obviously, if this criterion is not sat-
prised of all input channels, the data recipient is only isfied, no microdata can be revealed. One solution to
able to determine that each subject described by that theoverallproblemofsafelyassigningsubjectstoout-
output channel is at the same risk for a given disease put channels while minimizing total information loss
as the general population. Figure 3 illustrates a key isillustratedinFigure3.However,thatsolution,even
condition that must be satisfied in order to use this if safe, contains no useful information beyond that of
technique. Clearly a necessary and sufficient condi- Figure 2, except for the individual identifiers (IIDs).
tion for feasibility of the overall problem is that the Sinceallsubjectsareassignedtoasingleoutputchan-
output channel consisting of all input channels is nel,theybecomeindistinguishableandanyquerywill
“safe” (to be formally defined in §5). That is, mere result in a list that includes every subject in the data
membership in the original data set is not risky for set.
Garfinkel,Gopal,andThompson: PrivacyProtectionforIndividuallyIdentifiableMicrodata
InformationSystemsResearch18(1),pp.23–41,©2007INFORMS 29
Figure3 MinimalRevelation
Diabetes 0%
Heart 0% Input channel 1
(H,H,H,V)
Diabetes, Heart 67%
Diabetes, Heart, MRSA 33%
Subjects
Diabetes 0% assigned
Heart 0% Input channel 2 Name
(L,H,L,N)
Diabetes, Heart 0% M. A.
Diabetes, Heart, MRSA 0% G. P.
M. L.
Diabetes 0%
W. F.
Heart 25% Input channel 3 R. H.
(N,N,N,N)
Diabetes, Heart 0%
F. J.
Diabetes, Heart, MRSA 0%
M. G.
Output channel 1
{All} J. M.
Diabetes 50%
A. B.
Heart 0% Input channel 4 Diabetes 6.7%
J. R.
Diabetes, Heart 50% (N,N,N,H) Heart 13%
R. S.
Diabetes, Heart, MRSA 0% Diabetes, Heart 20%
R. G.
Diabetes, Heart, MRSA 6.7%
S. T.
Diabetes 0%
J. T.
Heart 0% Input channel 5
M. D.
(L,L,L,N)
Diabetes, Heart 0%
Diabetes, Heart, MRSA 0%
Diabetes 0%
Heart 50% Input channel 6
(N,N,V,N)
Diabetes, Heart 0%
Diabetes, Heart, MRSA 0%
A third approach involves partial revelation. This forsubjectsmeetingcertaincriteriawillbeguaranteed
is illustrated in Figure 4, where the data recipient to yield a set of subjects that includes the set of sub-
stillreceivessomeinformationregardingwhichinput jects that would have resulted from the same query
channels do not describe a given subject (e.g., M. A. runontheoriginaldataset.Second,thedatarecipient
is not in input channels 4, 5, or 6). is told the composition of each output channel, i.e.,
Figure 4 reveals some general concepts that are theinputchannelsthatcompriseeachoutputchannel,
important in the remainder of this work. First, it is is made known. Note that transformation from input
always the case that the output channel to which to output channels can be considered simply expan-
a subject has been assigned has, as an element, the sionoftheconfidentiality-relatedfields. Furthermore,
input channel that originally described the subject. by performing this expansion at the “channel level”
This ensures that the output database is “inclusive,” insteadofthe“attributelevel,”theuserreceivesmore
in the sense that any query on the released microdata useful information. Consider output channel 1 in
Garfinkel,Gopal,andThompson: PrivacyProtectionforIndividuallyIdentifiableMicrodata
30 InformationSystemsResearch18(1),pp.23–41,©2007INFORMS
Figure4 PartialRevelation
Diabetes 0%
Heart 0% Input channel 1
Diabetes, Heart 67% (H,H,H,V) Subjects
assigned
Diabetes, Heart, MRSA 33%
Name
M. A.
Diabetes 0%
G. P.
Heart 0% Input channel 2 Output channel 1
(L,H,L,N) {1,2,3} M. L.
Diabetes, Heart 0%
W. F.
Diabetes, Heart, MRSA 0% Diabetes 0%
R. H.
Heart 11%
Diabetes 0% F. J.
Diabetes, Heart 22%
Heart 25% Input channel 3 M. G.
Diabetes, Heart, MRSA 11%
(N,N,N,N) J. M.
Diabetes, Heart 0%
A. B.
Diabetes, Heart, MRSA 0%
Diabetes 50%
Heart 0% Input channel 4 Subjects
assigned
(N,N,N,H)
Diabetes, Heart 50%
Name
Diabetes, Heart, MRSA 0%
J. R.
Diabetes 0% R. S.
R. G.
Heart 0% Input channel 5 Output channel 2
(L,L,L,N) {4,5,6} S. T.
Diabetes, Heart 0%
J. T.
Diabetes, Heart, MRSA 0%
M. D.
Diabetes 17%
Diabetes 0%
Heart 17%
Heart 50% Input channel 6
Diabetes, Heart 17%
(N,N,V,N)
Diabetes, Heart 0%
Diabetes, Heart, MRSA 0%
Diabetes, Heart, MRSA 0%
Figure 4. At the attribute level it would be ((cid:6)L(cid:7)N(cid:7)H(cid:8), utility was lost. Notice that the mapping, while “dis-
(cid:6)N(cid:7)H(cid:8), (cid:6)L(cid:7)N(cid:7)H(cid:8), (cid:6)N(cid:7)V(cid:8)), which could be considered guising”whichinputchanneltrulydescribesasubject,
to be the union of 3×2×3×2=36 input channels, as alsoresultsintheadditionofspurioussubjects to any
opposedtothethreeinputchannelsofFigure4.Thus, query requesting subjects from a particular group. To
the data recipient receives much more precise infor- illustrate how utility is measured in this context, con-
mation regarding which input channels might accu- sider a public health worker who wishes to contact
rately describe the subjects and which do not. subjects who are at risk for MRSA. First, assume that
The solution in Figure 4 results in a data set that, the data provider has decided that he or she does not
ignoring safety, is more useful than the one depicted want any user to be able to infer that a given “risky”
inFigure3butlessusefulthanthatofFigure2.Topro- value of the confidential field applies to any subject
tecttheconfidentialityofthedatasubjects,somedata with “too great” a probability and that the mapping
Garfinkel,Gopal,andThompson: PrivacyProtectionforIndividuallyIdentifiableMicrodata
InformationSystemsResearch18(1),pp.23–41,©2007INFORMS 31
depicted in Figure 4 is feasible (i.e., safe by that cri- m: thenumberofindividualsinthedataset;
terion). For instance, the data provider may not want min: the number of individuals in the input
r
anyusertobeabletoinferthattheconfidentialvalue channel dsdin;
r
“Diabetes and Heart” applies to any subject with a min(cid:7)k: the number of individuals in din with
r r
probability greater than 0(cid:9)3. confidential value vk;
Then suppose a public health worker determined P(cid:1)vk(cid:2): the probability that an individual in
from the statistical data in Table 2 that subjects the data set has confidential value vk.
(cid:1)
described by input channel 1, i.e., (cid:6)H(cid:7)H(cid:7)H(cid:7)V(cid:8), rep- Clearly, P(cid:1)vk(cid:2)=(cid:1)1/m(cid:2) min(cid:7)k;
dirn∈Din r
resent the at-risk population in which he or she is P(cid:1)vk(cid:1)din(cid:2): the probability that an individual in din
r r
interested. By using the perturbed individually iden- has confidential value vk. It follows that
tifiablemicrodatarepresentedbyFigure4,aqueryfor P(cid:1)vk(cid:1)din(cid:2)=min(cid:7)k/min;
r r r
subjects described by input channel 1 would return a mout: the number of individuals in the output
w
listoftheninesubjectsdescribedbyoutputchannel1. channel dout;
w
Threeofthesesubjectstrulymeetthatsearchcriterion; P(cid:1)vk(cid:1)dout(cid:2): theprobabilitythatanindividualinout-
w
the other six do not. Also, because the probability put channel dout has confidential value
w
thatagivensubjectinoutputchannel1has“Diabetes vk (see (1) below);
and Heart” is 0(cid:9)22, membership in output channel 1 x : thenumberofindividualsininputchan-
rw
wouldnotposeariskbasedontheboundof0(cid:9)3estab- nel din∈dout that are assigned to output
r w
lished by the data provider. The public health worker channel dout.
w
also receives a guarantee that every subject he or she
The decisions to be made by the data provider
is interested in is included in the query output. The
are the composition of the output channels and how
addition of spurious subjects results in data that has
many subjects to assign from each input channel
less utility to the users, and because the optimization
to each output channel. There are two advantages
model of §6 maximizes data utility, the number of
to making subject assignment decisions at the input
spurioussubjectsaddedtoquerieswill,ingeneral,be
channellevel.Thatis,oncethex aredeterminedthe
as small as possible. rw
subjectsarethenrandomlyassignedfrominputchan-
Clearly, the amount of risk that the data provider
nels to output channels, independent of their confi-
tolerates has a direct bearing on the overall util-
dential field attribute values. First, the data provider
ity of the released microdata set. This fundamental
will not be required to take into account the confi-
trade-off between risk and utility, typically framed
dential field values of individual subjects. Second, by
in terms of an R-U confidentiality map (Duncan
all subjects in a given input channel being treated as
et al. 2003b), is an important decision aid for data
identical in terms of the distribution of the confiden-
providerstoeffectivelycreatetheIIMreleasestrategy.
tial field, the probability that an individual in output
The computational analysis reported in §7 provides
channel dout has confidential value vk is determined
important insights on the inherent nonlinearities in w
by
(cid:1)
the risk-utility relationship. P(cid:1)vk(cid:1)din(cid:2)x
P(cid:1)vk(cid:1)dout(cid:2)= dirn∈(cid:1)dowut r rw(cid:9) (1)
w x
4. The Channel Expansion Technique dirn∈dowut rw
Finally, because the x variables will, in general, be
We formally define an input channel din as the rw
r very large for realistic sized databases, there is no
vector of confidentiality-related attribute values that
practical reason to impose integrality on them.
describes the rth group of subjects. Let Din (cid:11)=(cid:6)din(cid:8)
r
andDout(cid:11)=(cid:6)dout(cid:8)bethesetofinputandoutputchan-
w 5. A General Model of Risk
nels, respectively. Also let V =(cid:6)vk: k=1(cid:7)(cid:9)(cid:9)(cid:9)(cid:7)K(cid:8) be
the set of possible “risky” values, v0 = “none,” and 5.1. Risky Input Channels
V(cid:4) =V ∪(cid:6)v0(cid:8). We will often abuse notation by writ- The first step is to partition the initial set of input
ing k∈V or k∈V(cid:4) to mean vk ∈V or vk ∈V(cid:4). The channels Din into two sets, risky and safe (cid:1)Rin(cid:7)Sin(cid:2).
following notation and definitions will also be used: Aninputchannelcanbedeemedriskybasedoneither
Garfinkel,Gopal,andThompson: PrivacyProtectionforIndividuallyIdentifiableMicrodata
32 InformationSystemsResearch18(1),pp.23–41,©2007INFORMS
a single confidential field or a combination of confi- e.g., din = (cid:1)N(cid:7)N(cid:7)N(cid:7)H(cid:2) ∈ Rin because P(cid:1)v1 (cid:1) din(cid:2) =
4 1 4
dential fields. In the first case, define din ∈Rin if din 0(cid:9)5>u =0(cid:9)25. Also notice that din∈Rin, illustrating
r r 1 4 3
is k-risky, denoted din ∈ Rin, for some k ∈ V. Then the point that, although satisfying the criterion for
r k
din∈Rin only if beingatriskforanyconfidentialfieldvalueisenough
r k
to classify an input channel as risky, it may be that a
P(cid:1)vk(cid:1)din(cid:2)>P(cid:1)vk(cid:2)(cid:9) (2)
r given input channel is at risk for multiple values of
That is, an individual in din is considered potentially theconfidentialfield,andeachofthesesourcesofrisk
r
at risk if the likelihood that his value in the confi- must be considered. Further, regardless of whether
(cid:1)
dential field is higher than that of a subject chosen din∈Rin for any k, din∈Rin because P(cid:1)vk(cid:1)din(cid:2)·
4 k 4 k∈V(cid:4) 4
at random from the original data set. It is possible c =1>0(cid:9)6.
k
that even if (2) holds, the data provider may wish to
5.2. The Safety of Output Channels Including
set a higher threshold to define whether the poten-
Assignments
tial threat is real enough to require action. An advan-
Here we establish conditions to determine whether
tageofdefiningahigherthresholdisthatthereleased
a given potential output channel is safe and, if so,
datasetwillultimatelyhavegreaterutilitytothedata
whether a given assignment of subjects to that out-
recipient, because less perturbation will be required
put channel is likewise safe. The set of potential out-
to make the data safe. The data provider can deter-
put channels is first limited to Sout, which are those
mine,valuebyvalue,themagnitudeofthethreatthat
output channels that cannot be a priori rejected, i.e.,
must be present to cause concern. To do this, a con-
output channels that cannot be determined to be
stantu ≥P(cid:1)vk(cid:2)isestablishedbythedataproviderfor
k infeasible independent of the x variables. A simple
every vk, such that din∈Rin if and only if rw
r k condition is that dout∈Sout if and only if
w
P(cid:1)vk(cid:1)din(cid:2)>u ≥P(cid:1)vk(cid:2)(cid:7) k∈V(cid:9) (3)
r k dout∩Sin(cid:10)=(cid:11)(cid:9) (5)
w
In the second case the data provider may be con-
If (5) does not hold, the user knows that every sub-
cerned,notonlywithwhetherthesubjectsinaninput
ject in dout comes from a risky input channel. The
channel are at risk for a given value of the confiden- w
only uncertainties for the user would be which din∈
tialfield,butalsowithsomemeasureof“howmuch” r
(cid:1)dout∩Rin(cid:2) correctly describes that subject, and there-
risk,aggregatedovertheconfidentialfieldvalues,can w
fore which element or elements of V cause that sub-
beassignedtosubjectsdescribedbythatchannel.The
ject to be at risk. In addition, there are a posteriori
data provider may feel that, even though (3) has not
conditions, based on the x variables, that determine
been satisfied for any k, the subjects in that channel rw
whether a given assignment of subjects to an out-
may still be at risk. In fact, decisions involving such
putchannelissafe.Theseconditionsareanalogousto
factors as employment or insurance coverage can be
(3) and (4) for input channels. Output channel w is
influenced by such “aggregate risk.” Thus the data
assignment safe only if
provider can assign a “weight” c to every k ∈ V(cid:4),
k
P(cid:1)vk(cid:1)dout(cid:2)≤u (cid:7) all k∈V(cid:7) (6)
whichindicateshowmuchofarelativethreatthatele- w k
ment is considered, where c is set to zero. Then the or from the definition of P(cid:1)vk(cid:1)dout(cid:2) in (1),
0 w
secondcriterionfordin∈Rin isthatthetotalweighted (cid:2)
r (cid:1)P(cid:1)vk(cid:1)din(cid:2)−u (cid:2)x ≤0(cid:7) all k∈V(cid:9) (7)
risk in din exceeds some parameter b established by r k rw
r
the data provider. That is, din∈Rin if dirn∈dowut
r
(cid:2) The second condition is the output channel analog
P(cid:1)vk(cid:1)din(cid:2)c >b(cid:9) (4) of (4), namely
r k
k∈V(cid:4) (cid:2)
cP(cid:1)vj(cid:1)dout(cid:2)≤b(cid:7) (8)
Then din ∈Rin if and only if (3) holds for some k j w
r j∈V(cid:4)
or (4) holds. To illustrate (3) and (4) from Table 2, let
which, from (1), is equivalent to
(cid:6)v1(cid:7)(cid:9)(cid:9)(cid:9)(cid:7)v4(cid:8) be (cid:6)“diabetes,” “heart,” “diabetes(cid:7)heart,” (cid:3) (cid:4)
(cid:2) (cid:2)
“diabetes, heart, MRSA”(cid:8)andsupposeu =0(cid:9)25,u =
1 2 b− cP(cid:1)vj(cid:1)din(cid:2) x ≥0(cid:9) (9)
0(cid:9)25, u =0(cid:9)3, u =0(cid:9)18, b=0(cid:9)6, c (cid:7)(cid:9)(cid:9)(cid:9)(cid:7)c =1. Then, j r rw
3 4 1 4 din∈dout j∈V(cid:4)
r w