Chapter 6 — Discrete structures | Bachelor's Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 06 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 Sets of data"]
  N2["6.2 Counting identities"]
  N3["6.3 Relations"]
  N4["6.4 Graphs of flows"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 Sets of data"]
  N2["6.2 Counting identities"]
  N3["6.3 Relations"]
  N4["6.4 Graphs of flows"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX016"]

[Learning outcomes]
    |
    v
[6.1 Sets of data]
    |
    v
[6.2 Counting identities]
    |
    v
[6.3 Relations]
    |
    v
[6.4 Graphs of flows]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) use sets and relations to model data sharing; (2) count combinations that identify pupils; (3) use graphs to trace data flows.

6.1 Sets of data

Elena models the trust's data as sets: all personal data, special category data such as health and religion, and data about children with special educational needs. She notes that some data belong to several sets. A list of pupils with dietary requirements may reveal religion or health. Set thinking helps her see that data which look ordinary can fall into sensitive categories, which GDPR Article 9 protects with stricter conditions. She uses Venn diagrams in her report to the trust. Health data are one example.

6.2 Counting identities

Elena counts how many pupils share combinations of attributes in a small school: year group, sex and first language. In a school of two hundred, some combinations contain one child. Publishing a table of results by these attributes could identify that child. She connects this to Sweeney's (2002) work on how combinations of ordinary attributes identify individuals. The counting exercise shows her why statistics about small schools need special care before publication. In a school with one pupil of a given age and ethnicity, the counts identify that child.

6.3 Relations

A relation pairs elements from two sets. Elena models which staff roles can access which data categories as a relation. Teachers access learning records; office staff access contact details; the special needs coordinator accesses support plans. She checks the relation against the principle of least privilege and finds that office staff can also access support plans, which they do not need. The model makes the problem visible in a way that a list of permissions in a software menu did not. Removing it narrows access.

6.4 Graphs of flows

Elena draws the trust's data flows as a directed graph: from parents to schools, from schools to apps, from apps to vendors' subprocessors. She finds paths that leave the trust through several steps, such as a reading app passing data to an analytics provider. A path, she notes, is only as protected as its weakest link. The graph prepares her for later chapters, where she will check each edge for a lawful basis and a contract. Each edge is a flow.

Worked example

Elena models data categories as sets, counts identifying combinations in small schools, models role access as a relation (finding office access to support plans) and traces multi-step flows as a graph.

Synthetic case. Models are synthetic; GDPR Article 9 and Sweeney (2002) are real.

Errors and limits

Models simplify; real access often has exceptions not captured in role tables.

Exercises

EX016 — Ordinary but sensitive. Give an example of ordinary-looking data that may be special category.
Show marking criteria
Rubric: 3 = dietary requirements revealing religion or health;; 2 = example given;; 1 = vague;; 0 = none.
EX017 — Access relation finding. What did the access relation reveal?
Show marking criteria
Rubric: 3 = office staff could access support plans they do not need;; 2 = mentions office;; 1 = vague;; 0 = none.
EX018 — Weakest link path. Why is a multi-step data path only as protected as its weakest link?
Show marking criteria
Rubric: 3 = data can leak at any step, such as a subprocessor;; 2 = mentions steps;; 1 = strongest;; 0 = none.

Synthesis

Chapter 6 models data. Chapter 7 covers networks.

Continue studying — chapter 06 of 40

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →