Individual Differential Privacy: A Utility-Preserving Formulation of Differential Privacy Guarantees

TL;DR

This paper introduces individual differential privacy, a relaxed privacy model that offers the same individual privacy guarantees as standard differential privacy but allows for less data distortion and improved utility by adjusting protection based on the actual data.

Contribution

The paper proposes a new privacy notion called individual differential privacy, which relaxes standard differential privacy to improve data utility while maintaining individual privacy guarantees.

Findings

Individual differential privacy provides comparable privacy guarantees to standard differential privacy.

Mechanisms are developed to achieve individual differential privacy.

Results show improved accuracy of data analysis under the new privacy model.

Abstract

Differential privacy is a popular privacy model within the research community because of the strong privacy guarantee it offers, namely that the presence or absence of any individual in a data set does not significantly influence the results of analyses on the data set. However, enforcing this strict guarantee in practice significantly distorts data and/or limits data uses, thus diminishing the analytical utility of the differentially private results. In an attempt to address this shortcoming, several relaxations of differential privacy have been proposed that trade off privacy guarantees for improved data utility. In this work, we argue that the standard formalization of differential privacy is stricter than required by the intuitive privacy guarantee it seeks. In particular, the standard formalization requires indistinguishability of results between any pair of neighbor data sets, while indistinguishability between the actual data set and its neighbor data sets should be enough. This limits the data controller's ability to adjust the level of protection to the actual data, hence resulting in significant accuracy loss. In this respect, we propose individual differential privacy, an alternative differential privacy notion that offers em the same privacy guarantees as standard differential privacy to individuals (even though not to groups of individuals). This new notion allows the data controller to adjust the distortion to the actual data set, which results in less distortion and more analytical accuracy. We propose several mechanisms to attain individual differential privacy and we compare the new notion against standard differential privacy in terms of the accuracy of the analytical results.