Chapter 1 — Advanced research integrity and methods
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 A falsifiable question"]
N2["1.2 Why the question matters"]
N3["1.3 Integrity rules"]
N4["1.4 Uniqueness as a baseline"]
N5["Lab — Uniqueness of synthetic riders on quasi-identi"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 A falsifiable question"]
N2["1.2 Why the question matters"]
N3["1.3 Integrity rules"]
N4["1.4 Uniqueness as a baseline"]
N5["Lab — Uniqueness of synthetic riders on quasi-identi"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 A falsifiable question]
|
v
[1.2 Why the question matters]
|
v
[1.3 Integrity rules]
|
v
[1.4 Uniqueness as a baseline]
|
v
[Lab — Uniqueness of synthetic riders on quasi-identi]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) frame a falsifiable question about privacy-preserving data release; (2) set integrity rules for research that touches personal data; (3) measure how quickly ordinary attributes make people unique.
1.1 A falsifiable question
Ines Carvalho is a doctoral candidate at the fictional Thornbury University, supervised by Prof. Henrik Aaltonen. Her partner is the fictional Valemont Regional Transit Authority, which collects smart-card journeys and wants to publish travel data for city planners. Ines asks whether releasing differentially private origin-destination counts protects riders better than releasing k-anonymised journey records, at a utility planners still accept. Before collecting anything she writes down which results would prove her wrong: no measurable reduction in linkage risk, or an error so large that planners reject the counts for routine timetable decisions.
1.2 Why the question matters
The question matters because transit data looks harmless but describes where people live, work and pray. Under Regulation (EU) 2016/679, the GDPR, data that can single out a person remain personal data, while Recital 26 places truly anonymous information outside the regulation. The Brazilian LGPD, Lei 13.709/2018, draws a similar line in its definition of anonymised data. Whether a release counts as anonymous is therefore a legal as well as a technical question. Ines treats it as an empirical claim to be tested rather than a label that the authority can simply apply to a spreadsheet before publishing it.
1.3 Integrity rules
Research on personal data must not create the harm it studies. Ines's protocol, approved by the Thornbury ethics committee and reviewed by Valemont's data protection officer, sets five rules. She works only on a synthetic population generated to match published aggregate statistics; no real card numbers leave the authority; any attack experiment targets the synthetic population, never real riders; the analysis plan is pre-registered before results are seen; and every file leaving the secure environment is checked for direct identifiers. She also declares that she has no commercial interest in any anonymisation product or consultancy.
1.4 Uniqueness as a baseline
Before comparing release methods, Ines measures how identifying ordinary attributes are. Sweeney (2002) showed that a few quasi-identifiers such as postcode, birth date and sex can single out most people, which motivated the k-anonymity model. The lab builds 20,000 synthetic riders with a home zone, a work zone, a birth year and a sex, then counts the share who are unique on growing combinations. Home zone alone singles out nobody, and home plus work zone singles out nobody either, but adding birth year makes 83.4% unique, and adding sex raises the figure to 91.5% of the synthetic population.
Lab — Uniqueness of synthetic riders on quasi-identifiers
# Share of synthetic transit riders who are unique on combinations of quasi-identifiers.
import random
from collections import Counter
r = random.Random(7)
riders = [(r.randrange(40), r.randrange(40), r.randrange(1940, 2008), r.choice("FM")) for _ in range(20000)]
def unique(cols):
keys = [tuple(x[c] for c in cols) for x in riders]
c = Counter(keys)
return sum(1 for k in keys if c[k] == 1) / len(keys)
for name, cols in [("home zone", (0,)), ("home + work zone", (0, 1)),
("home + work + birth year", (0, 1, 2)), ("home + work + birth year + sex", (0, 1, 2, 3))]:
print(f"{name:32s} unique {unique(cols):6.1%}")
Run with python3 lab_unique.py. Verified output:
home zone unique 0.0%
home + work zone unique 0.0%
home + work + birth year unique 83.4%
home + work + birth year + sex unique 91.5%
Worked example
Ines frames a falsifiable comparison between k-anonymised records and differentially private counts, sets integrity rules for research on transit data and records a baseline: 83.4% of synthetic riders are unique on home zone, work zone and birth year.
Synthetic case. Thornbury, Valemont and every rider are synthetic; the GDPR, the LGPD and Sweeney (2002) are real.
Errors and limits
Uniqueness in a synthetic population only approximates uniqueness in the real one. Being unique is not the same as being re-identified; an attacker also needs outside knowledge.
Exercises
- EX001 — Falsifiable plan. What makes Ines's research question falsifiable? Rubric: 3 = she lists in advance results that would refute it: no drop in linkage risk or unacceptable error;; 2 = mentions pre-stated outcomes vaguely;; 1 = says it is a good question;; 0 = none.
- EX002 — Anonymous in law. Why is "anonymous" a legal as well as a technical question for the authority? Rubric: 3 = GDPR Recital 26 and the LGPD place anonymous data outside the law, so the label changes legal duties;; 2 = cites one law only;; 1 = says it is technical;; 0 = none.
- EX003 — Synthetic population. Why does Ines work on a synthetic population instead of real cards? Rubric: 3 = it lets her run attacks and publish results without exposing or re-identifying real riders;; 2 = says it is easier;; 1 = says real data is unavailable;; 0 = none.
- EX004 — Uniqueness jump. Which attribute causes the biggest jump in uniqueness in the lab, and why? Rubric: 3 = birth year: from 0% to 83.4%, because it splits each zone pair into many small groups;; 2 = names birth year without numbers;; 1 = names zone;; 0 = none.
- EX005 — Unique versus identified. Why is uniqueness not yet re-identification? Rubric: 3 = an attacker also needs outside knowledge that links the unique combination to a named person;; 2 = says they differ;; 1 = treats them as equal;; 0 = none.
- EX006 — Interest declaration. Why does Ines declare that she has no commercial interest? Rubric: 3 = readers can judge bias; a product interest could tilt the method comparison;; 2 = says it is required;; 1 = omits reasons;; 0 = none.
- EX007 — Pre-registration value. What does pre-registering the analysis plan protect against? Rubric: 3 = choosing metrics or thresholds after seeing results that flatter one method;; 2 = mentions bias generally;; 1 = says it is paperwork;; 0 = none.
Synthesis
Chapter 1 sets a falsifiable question, integrity rules and a uniqueness baseline. Chapter 2 maps the research frontier from Warren and Brandeis to differential privacy.