The explosion in volume and variety of data offers enormous potential for research and commercial use. Increased availability of personal data is of particular interest in enabling highly customised services tuned to individual needs. Preserving the privacy of individuals against reidentification attacks in this fast-moving ecosystem poses significant challenges for a one-size fits all approach to anonymisation. In this paper we present ( @math , @math )-anonymisation, an approach that combines the @math -anonymisation and @math -differential privacy models into a single coherent framework, providing privacy guarantees at least as strong as those offered by the individual models. Linking risks of less than 5 are observed in experimental results, even with modest values of @math and @math . Our approach is shown to address well-known limitations of @math -anonymity and @math -differential privacy and is validated in an extensive experimental campaign using openly available datasets.
@cite_7: k-anonymity and e-differential privacy are two mainstream privacy models, the former introduced to anonymize data sets and the latter to limit the knowledge gain that results from including one individual in the data set. Whereas basic k-anonymity only protects against identity disclosure, t-closeness was presented as an extension of k-anonymity that also protects against attribute disclosure. We show here that, if not quite equivalent, t-closeness and e-differential privacy are strongly related to one another when it comes to anonymizing data sets. Specifically, k-anonymity for the quasi-identifiers combined with e-differential privacy for the confidential attributes yields stochastic t-closeness (an extension of t-closeness), with t a function of k and e. Conversely, t-closeness can yield e-differential privacy when t=exp(e 2) and the assumptions made by t-closeness about the prior and posterior views of the data hold.
@cite_7 the authors present a comparison between the privacy guarantees provided by applying @math -anonymity and @math -differential privacy. Also, the authors provide a mechanism to approximate the equivalent @math parameter of a @math -closeness setting and vice-versa.