k-anonymous Microdata Release via Post Randomisation Method

TL;DR

This paper introduces Pk-anonymity, a new probabilistic privacy measure that extends k-anonymity without parametric assumptions, and applies it to enhance the privacy guarantees of the PRAM method, linking it to differential privacy.

Contribution

The paper proposes Pk-anonymity as a new probabilistic extension of k-anonymity and demonstrates its application to PRAM, unifying it with differential privacy.

Findings

Pk-anonymity is a true extension of k-anonymity.

PRAM can be controlled to satisfy Pk-anonymity.

PRAM also satisfies ε-differential privacy.

Abstract

The problem of the release of anonymized microdata is an important topic in the fields of statistical disclosure control (SDC) and privacy preserving data publishing (PPDP), and yet it remains sufficiently unsolved. In these research fields, k-anonymity has been widely studied as an anonymity notion for mainly deterministic anonymization algorithms, and some probabilistic relaxations have been developed. However, they are not sufficient due to their limitations, i.e., being weaker than the original k-anonymity or requiring strong parametric assumptions. First we propose Pk-anonymity, a new probabilistic k-anonymity, and prove that Pk-anonymity is a mathematical extension of k-anonymity rather than a relaxation. Furthermore, Pk-anonymity requires no parametric assumptions. This property has a significant meaning in the viewpoint that it enables us to compare privacy levels of probabilistic microdata release algorithms with deterministic ones. Second, we apply Pk-anonymity to the post randomization method (PRAM), which is an SDC algorithm based on randomization. PRAM is proven to satisfy Pk-anonymity in a controlled way, i.e, one can control PRAM's parameter so that Pk-anonymity is satisfied. On the other hand, PRAM is also known to satisfy ${\varepsilon}$-differential privacy, a recent popular and strong privacy notion. This fact means that our results significantly enhance PRAM since it implies the satisfaction of both important notions: k-anonymity and ${\varepsilon}$-differential privacy.