The Value of Privacy: Strategic Data Subjects, Incentive Mechanisms and Fundamental Limits

TL;DR

This paper models the trade-off between data privacy and payment in data collection, establishing fundamental limits and designing mechanisms to optimize privacy payments in a game-theoretic setting.

Contribution

It introduces a game-theoretic framework for privacy valuation, deriving tight bounds on privacy costs and designing near-optimal incentive mechanisms.

Findings

Lower bounds on privacy payment costs

Upper bounds with designed mechanisms

Total payment close to the minimum for target accuracy

Abstract

We study the value of data privacy in a game-theoretic model of trading private data, where a data collector purchases private data from strategic data subjects (individuals) through an incentive mechanism. The private data of each individual represents her knowledge about an underlying state, which is the information that the data collector desires to learn. Different from most of the existing work on privacy-aware surveys, our model does not assume the data collector to be trustworthy. Then, an individual takes full control of its own data privacy and reports only a privacy-preserving version of her data. In this paper, the value of $\epsilon$ units of privacy is measured by the minimum payment of all nonnegative payment mechanisms, under which an individual's best response at a Nash equilibrium is to report the data with a privacy level of $\epsilon$. The higher $\epsilon$ is, the less private the reported data is. We derive lower and upper bounds on the value of privacy which are asymptotically tight as the number of data subjects becomes large. Specifically, the lower bound assures that it is impossible to use less amount of payment to buy $\epsilon$ units of privacy, and the upper bound is given by an achievable payment mechanism that we designed. Based on these fundamental limits, we further derive lower and upper bounds on the minimum total payment for the data collector to achieve a given learning accuracy target, and show that the total payment of the designed mechanism is at most one individual's payment away from the minimum.