Bistochastically private release of longitudinal data

TL;DR

This paper introduces a simple, bistochastic matrix-based method for anonymizing longitudinal data, balancing privacy and data utility by leveraging properties of bistochastic matrices and their relationship to individual trajectories.

Contribution

It proposes a novel, straightforward approach using bistochastic matrices for privacy-preserving release of longitudinal data, extending randomized response techniques.

Findings

Established new results on bistochastic matrices.

Linked individual trajectory privacy to data release protections.

Demonstrated the approach with an empirical example.

Abstract

Although the bulk of the research in privacy and statistical disclosure control is designed for cross-sectional data, i.e. data where individuals are observed at one single point in time, longitudinal data, i.e. individuals observed over multiple periods, are increasingly collected. Such data enhance undoubtedly the possibility of statistical analysis compared to cross-sectional data, but also come with one additional layer of information, individual trajectories, that must remain practically useful in a privacy-preserving way. Few extensions, essentially k-anonymity based, of popular privacy tools have been proposed to deal with the challenges posed by longitudinal data, and these proposals are often complex. By considering randomized response, and specifically its recent bistochastic extension, in the context of longitudinal data, this paper proposes a simple approach for their anonymization. After having characterized new results on bistochastic matrices, we show that a simple relationship exists between the protection of each data set released at each period, and the protection of individuals trajectories over time. In turn, this relationship can be tuned according to desired protection and information requirements. We illustrate the application of the proposed approach by an empirical example.