System and method for objective quantification and mitigation of privacy risk

1 . A system for estimating privacy risk measures, the system comprising:

an input-output (IO) interface programmed to access at least one input dataset, on at least one of which a measurement of the risk is to be performed;

a processor programmed to:

determine the size of at least one dataset from among the at least one input dataset;

based on the size of the at least one dataset being larger than a threshold, compute a statistically representative sample size, subsample the at least one dataset based on the representative sample size, and estimate a privacy risk based on the subsampled dataset; and

perform one or more column level measurements on the subsampled dataset and one or more row level measurements on the at least one dataset; and

compute a privacy risk based on the column level measurements on the subsampled dataset and the row level measurements on the at least one dataset,

wherein based on the column level and row level measurements, the IO interface outputs a privacy risk.

2 . The system of claim 1 , wherein the processor is further programmed to, based on the size of at least one dataset being smaller than a threshold, perform column level measurements on at least one dataset and row level measurements on at least one dataset.

3 . The system of claim 1 , wherein the processor is further programmed to identify one or more mitigating measures to reduce the privacy risk by taking into account the factors that are contributing to higher risk.

4 . The system of claim 3 , wherein the processor is further programmed to provide a risk-based recommendation to reduce the privacy risk in the input dataset.

5 . The system of claim 3 wherein the processor is further programmed to provide one or more actions to mitigate each privacy-risk identified by the scoring engine.

6 . The system of claim 3 wherein the processor is further programmed to apply one or more mitigation techniques to the dataset based on one or more mitigating measures defined in a configuration file or selected from the identified mitigating measures.

7 . The system of claim 6 wherein the mitigation techniques include at least one of deletion, multiplication, redaction suppression, and fuzzing, generalization, noise addition, aggregation and masking.

8 . The system of claim 1 , wherein the processor is further programmed to: determine whether each of the records in a dataset is unique in its entirety or with regards to subsets of columns that comprise the record; compare entire records and subsets of columns from at least two input datasets to determine the level of similarity in terms of data reproduction or overlap that exists; measure statistical characteristics that capture information about input datasets, the captured information used to determine the level of re-identification risk the input datasets contain; and a quantify contextual factors via weighting and producing a single context-centric score.

9 . The system of claim 8 wherein the processor is further programmed to use an optimization to identify subsets of columns that have high resolving power relative to a data subject.

10 . The system of claim 8 , wherein the processor is further programmed to compose one or more output scores into a single privacy-risk score.

11 . The system of claim 1 , wherein the processor is further programmed to compute at least one privacy-risk score and produces a risk report by accounting for contextual factors and data-centric features in the input dataset.

12 . The system of claim 1 , wherein the processor is further programmed to compute scores for at least one of a synthetic dataset, an anonymized dataset, a raw dataset, and a row-level datasets.

13 . The system of claim 1 wherein the IO interface outputs the risk output for at least one input dataset.

14 . The system of claim 1 wherein the system minimizes overt re-identification risks.

15 . The system of claim 14 wherein the re-identification risks include potential risks specified in a configuration file.

16 . The system of claim 1 , wherein the one or more column level measurements include multi-dimensional attribute analysis based on combinations of columns within the subsampled dataset, and wherein the processor is further programmed to:

evaluate correlations between quasi-identifiers and identifier columns to determine uniqueness scores that quantify how strongly the quasi-identifiers are correlated with identifiers in the dataset and indicate a likelihood of re-identification of records in the dataset.

17 . The system of claim 1 , wherein the processor is further programmed to:

determine whether the computed privacy risk satisfies a threshold;

based on the privacy risk not satisfying the threshold, generate one or more mitigation recommendations; and

iteratively re-compute the privacy risk after applying the one or more mitigation recommendations.

18 . The system of claim 1 , wherein the processor is further programmed to:

perform an optimization process to limit evaluation of combinations of columns in the column level measurements based on a search technique selected from a hill-climbing algorithm, genetic algorithm, gradient descent, or simulated annealing.

19 . A computer-implemented method for estimating privacy risk measures, the method comprising:

accessing, via an input-output (IO) interface, at least one input dataset on which a measurement of privacy risk is to be performed;

determining, by a processor, a size of at least one dataset from among the at least one input dataset;

based on determining that the size of the at least one dataset is larger than a threshold, computing a statistically representative sample size, subsampling the at least one dataset based on the statistically representative sample size, and estimating a privacy risk based on the subsampled dataset;

performing one or more column level measurements on the subsampled dataset and one or more row level measurements on the at least one dataset;

computing a privacy risk based on the column level measurements on the subsampled dataset and the row level measurements on the at least one dataset; and

outputting, via the IO interface, the privacy risk based on the column level and row level measurements.

20 . A system for estimating privacy risk measures, the system comprising:

an input-output (IO) interface programmed to access at least one input dataset, on at least one of which a measurement of the risk is to be performed;

a processor programmed to:

determine the size of at least one dataset from among the at least one input dataset;

based on the size of the at least one dataset being larger than a threshold, compute a statistically representative sample size, subsample the at least one dataset based on the representative sample size, and estimate a privacy risk based on the subsampled dataset; and

perform one or more column level measurements on the subsampled dataset and one or more row level measurements on the at least one dataset;

compute a privacy risk based on the column level measurements on the subsampled dataset and the row level measurements on the at least one dataset,

wherein based on the column level and row level measurements, the IO interface outputs a privacy risk;

identify one or more mitigating measures to reduce the privacy risk by taking into account one or more factors that are contributing to higher risk; and

apply one or more mitigation techniques to the dataset based on a mitigating measure defined in a configuration file or selected from the identified mitigating measures.