Asymmetric journalist risk model of data re-identification
System and method to produce an anonymized cohort, members of the cohort having less than a predetermined risk of re-identification. The system includes a user-facing communication interface to receive an anonymized cohort request comprising traits to include in members of the cohort; a data source-facing communication channel to query a data source, to find anonymized records that possess at least some of the requested traits; and a processor programmed to carry out the instructions of: forming a dataset from at least some of the anonymized records; calculating a risk of re-identification of the anonymized records in the dataset based upon the data query; perturbing anonymized records in the dataset that exceed a predetermined risk of re-identification, until the risk of re-identification is not greater than the pre-determined threshold, to produce the anonymized cohort; and providing, via a user-facing communication channel, the anonymized cohort.
1. A method of lowering a risk of re-identification of one or more of a plurality of members of the method comprising steps of:
on a processor:
receiving a request for anonymized data comprising a subset of the plurality of members of the cohort having one or more requested traits;
forming a dataset of a plurality of anonymized cohort records describing the members of the cohort having the one or more requested traits;
determining one or more quasi-identifiers of the plurality of members in the dataset and a measure of risk of re-identification to be assessed for the dataset, the one or more quasi-identifiers comprise any of
public quasi-identifiers known from public sources, and
acquaintance quasi-identifiers known from private sources related to the plurality of members in the dataset;
calculating a risk of re-identification of the one or more of the plurality of members of the cohort included in the dataset based upon the one or more quasi-identifiers and the determined measure of risk of re-identification;
comparing the calculated risk of re-identification to a predetermined threshold;
lowering the risk of re-identification below the predetermined threshold, without degrading the selected anonymized data, when the calculated risk of re-identification exceeds the predetermined threshold; and
providing anonymized dataset in response to the request.
2. The method of claim 1 , wherein the risk of re-identification is calculated separately for a public attack using public quasi-identifiers and separately for an acquaintance attack using public and acquaintance quasi-identifiers.
3. The method of claim 1 , further comprising a step of perturbing the anonymized records in the dataset that exceed the predetermined threshold, until the risk of re-identification is not greater than the pre-determined threshold.
4. The method of claim 1 , wherein the step of calculating a risk of re-identification further comprises the steps of:
combining pre-existing external dataset and the formed dataset.
5. The method of claim 3 , wherein the step of perturbing comprises changing a size of the formed dataset.
6. The method of claim 3 , wherein the step of perturbing comprises changing a quantity of records in the dataset.
7. The method of claim 3 , wherein the step of comprises changing a value in at least one record in the dataset.
8. The method of claim 3 , wherein the step of perturbing comprises including in the dataset at least one record that does not meet all of the requested traits.
9. A system to of lower a risk of re-identification of one or more of a plurality of members of a cohort, the system comprising:
providing a processor configured to:
receive a request for anonymized data comprising a subset of the plurality of members of the cohort having one or more requested traits;
form a dataset of a plurality of anonymized cohort records describing the members of the cohort having the one or more requested traits;
determine one or more quasi-identifiers of the plurality of members in the dataset and a measure of risk of re-identification to be assessed for the dataset, the one or more quasi-identifiers comprise any of
public quasi-identifiers known from public sources, and
acquaintance quasi-identifiers known from private sources related to the plurality of members in the dataset;
calculate a risk of re-identification of the one or more of the plurality of members of the cohort included in the dataset based upon the one or more quasi-identifiers and the determined measure of risk of re-identification;
compare the calculated risk of re-identification to a predetermined threshold;
lower the risk of re-identification below the predetermined threshold, without degrading the selected anonymized data, when the calculated risk of re-identification exceeds the predetermined threshold; and
provide the anonymized dataset in response to the request.
10. The system of claim 9 , wherein the risk of re-identification is calculated separately for a public attack using public quasi-identifiers and for an acquaintance attack using public and acquaintance quasi-identifiers.
11. The system of claim 9 , wherein the processor is further configured to perturb the anonymized records in the dataset that exceed the predetermined threshold, until the risk of re-identification is not greater than the pre-determined threshold.
12. The system of claim 9 , wherein the risk of re-identification is calculated by combining pre-existing external dataset and the formed dataset.
13. The system of claim 11 , wherein perturbing comprises changing a size of the formed dataset.
14. The system of claim 11 , wherein perturbing comprises changing a quantity of records in the dataset.
15. The system of claim 11 , wherein perturbing comprises changing a value in at least one record in the dataset.
16. The system of claim 11 , wherein perturbing comprises including in the dataset at least one record that does not meet all of the requested traits.