Estimating Residual Privacy Loss after Data De-Identification

1 . A non-transitory computer readable medium storing a software program comprising data and computer implementable instructions for carrying out a method for estimating residual privacy loss after data de-identification, the method comprising:

accessing a data collection to generate a de-identified copy of the data collection;

determining a first amount of residual identified information of a first type of residual identified information in the generated de-identified copy;

determining a second amount of residual identified information of a second type of residual identified information in the generated de-identified copy, the second type differs from the first type;

selecting a usage policy for the generated de-identified copy based on the first amount of residual identified information and the second amount of residual identified information in the generated de-identified copy; and

implementing the selected usage policy.

2 . The non-transitory computer readable medium of claim 1 , wherein the method further comprises analyzing the generated de-identified copy to determine the first and second amounts of residual identified information in the generated de-identified copy.

3 . The non-transitory computer readable medium of claim 1 , wherein the method further comprises analyzing the data collection to determine the first and second amounts of residual identified information in the generated de-identified copy.

4 . The non-transitory computer readable medium of claim 1 , wherein the method further comprises analyzing the generated de-identified copy and the data collection to determine the first and second amounts of residual identified information in the generated de-identified copy.

5 . The non-transitory computer readable medium of claim 1 , wherein the method further comprises:

calculating a function of the first amount of residual identified information and the second amount of residual identified information to thereby obtain a risk level; and

selecting the usage policy for the generated de-identified copy based on the risk level.

6 . The non-transitory computer readable medium of claim 5 , wherein the function is a non-linear function.

7 . The non-transitory computer readable medium of claim 1 , wherein the first type of residual identified information is at least one of residual identified information associated with visual data, residual identified information associated with audio data, residual identified information associated with textual data, residual identified information associated with numerical data, or residual identified information associated with temporal data.

8 . The non-transitory computer readable medium of claim 1 , wherein the first type of residual identified information is associated with visual data, and the method further comprises:

calculating a convolution of at least part of an image included in the de-identified copy of the data collection to obtain a result value of the calculated convolution; and

determining the first amount of residual identified information based on the result value of the calculated convolution.

9 . The non-transitory computer readable medium of claim 1 , wherein the first type of residual identified information is associated with visual data, and the method further comprises:

calculating a first convolution of at least part of an image included in the data collection to obtain a result value of the first calculated convolution;

calculating a second convolution of at least part of an image included in the de-identified copy of the data collection to obtain a result value of the second calculated convolution; and

determining the first amount of residual identified information based on the result value of the first calculated convolution and the result value of the second calculated convolution.

10 . The non-transitory computer readable medium of claim 1 , wherein the first type of residual identified information is associated with audio data, and the method further comprises:

calculating a convolution of at least part of audio data included in the de-identified copy of the data collection to obtain a result value of the calculated convolution; and

determining the first amount of residual identified information based on the result value of the calculated convolution.

11 . The non-transitory computer readable medium of claim 1 , wherein the first type of residual identified information is associated with audio data, and the method further comprises:

calculating a first convolution of at least part of audio data included in the data collection to obtain a result value of the first calculated convolution;

calculating a second convolution of at least part of audio data included in the de-identified copy of the data collection to obtain a result value of the second calculated convolution; and

determining the first amount of residual identified information based on the result value of the first calculated convolution and the result value of the second calculated convolution.

12 . The non-transitory computer readable medium of claim 1 , wherein the method further comprises:

analyzing the data collection to identify a particular piece of information in the data collection and to determine a context of the particular piece of information in the data collection;

analyzing the de-identified copy of the data collection to detect the particular piece of information and to determine a context of the detected particular piece of information in the de-identified copy of the data collection; and

determining the first amount of residual identified information based on the determined context of the particular piece of information in the data collection and the determined context of the detected particular piece of information in the de-identified copy of the data collection.

13 . The non-transitory computer readable medium of claim 1 , wherein the first type of residual identified information is associated with temporal data, and the method further comprises:

analyzing the data collection to identify a particular date in the data collection and to determine a context of the particular date in the data collection;

analyzing the de-identified copy of the data collection to detect the particular date and to determine a context of the detected particular date in the de-identified copy of the data collection; and

determining the first amount of residual identified information based on the determined context of the particular date in the data collection and the determined context of the detected particular date in the de-identified copy of the data collection.

14 . The non-transitory computer readable medium of claim 1 , wherein the first type of residual identified information is associated with visual data and the second type of residual identified information is associated with audio data.

15 . The non-transitory computer readable medium of claim 1 , wherein the first type of residual identified information is associated with visual data and the second type of residual identified information is associated with textual data.

16 . The non-transitory computer readable medium of claim 1 , wherein the first type of residual identified information is associated with numerical data and the second type of residual identified information is associated with textual data.

17 . The non-transitory computer readable medium of claim 1 , wherein the first type of residual identified information is information likely to identify particular individuals and the second type of residual identified information is information likely to identify groups that particular individuals belong to.

18 . The non-transitory computer readable medium of claim 1 , wherein the first type of residual identified information is information likely to identify small groups that particular individuals belong to, and the second type of residual identified information is information likely to identify larger groups that particular individuals belong to.

19 . A system for estimating residual privacy loss after data de-identification, the system comprising:

at least one processing unit configured to:

accessing a data collection to generate a de-identified copy of the data collection;

determining a first amount of residual identified information of a first type of residual identified information in the generated de-identified copy;

determining a second amount of residual identified information of a second type of residual identified information in the generated de-identified copy, the second type differs from the first type;

selecting a usage policy for the generated de-identified copy based on the first amount of residual identified information and the second amount of residual identified information in the generated de-identified copy; and

implementing the selected usage policy.

20 . A method for estimating residual privacy loss after data de-identification, the method comprising:

accessing a data collection to generate a de-identified copy of the data collection;

determining a first amount of residual identified information of a first type of residual identified information in the generated de-identified copy;

determining a second amount of residual identified information of a second type of residual identified information in the generated de-identified copy, the second type differs from the first type;

selecting a usage policy for the generated de-identified copy based on the first amount of residual identified information and the second amount of residual identified information in the generated de-identified copy; and

implementing the selected usage policy.