Chapter 2 — Privacy and data protection: research frontier | Doctoral research Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 02 published. Map, example, EX008.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 From a right to be let alone"]
  N2["2.2 Syntactic anonymity models"]
  N3["2.3 Linkage and de-anonymisation"]
  N4["2.4 Differential privacy"]
  N5["2.5 The gap"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX008"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 From a right to be let alone"]
  N2["2.2 Syntactic anonymity models"]
  N3["2.3 Linkage and de-anonymisation"]
  N4["2.4 Differential privacy"]
  N5["2.5 The gap"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX008"]

[Learning outcomes]
    |
    v
[2.1 From a right to be let alone]
    |
    v
[2.2 Syntactic anonymity models]
    |
    v
[2.3 Linkage and de-anonymisation]
    |
    v
[2.4 Differential privacy]
    |
    v
[2.5 The gap]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX008]

Learning outcomes

You will (1) trace how privacy theory developed; (2) contrast syntactic anonymity models with differential privacy; (3) locate the gap Ines's study addresses.

2.1 From a right to be let alone

Ines begins her review with Warren and Brandeis (1890), who argued in the Harvard Law Review for a right to privacy against intrusive photography and gossip. Solove (2006) later argued that privacy is not one thing and offered a taxonomy of harmful activities grouped as information collection, information processing, information dissemination and invasion. Nissenbaum (2004, 2009) proposed contextual integrity: a flow of information is appropriate when it respects the norms of the context in which it was shared. For transit data, contextual integrity asks whether riders expect their journeys to reach city planners in any form at all.

2.2 Syntactic anonymity models

The first technical family protects records by making them look alike. Sweeney (2002) defined k-anonymity: each combination of quasi-identifiers must be shared by at least k records. Machanavajjhala and colleagues (2007) showed that a k-anonymous group can still reveal a sensitive value if everyone in it shares that value, and proposed l-diversity. Li, Li and Venkatasubramanian (2007) proposed t-closeness, which requires the sensitive distribution in each group to stay close to the overall distribution. Ines notes that each model was proposed after an attack on the previous one, which suggests that syntactic guarantees depend on assumptions about the attacker.

2.3 Linkage and de-anonymisation

Narayanan and Shmatikov (2008) showed that a supposedly anonymous dataset of film ratings could be linked to public reviews using only a few known ratings, because sparse records are highly distinctive. Their result generalises to transit journeys, which are also sparse and distinctive. Garfinkel's NIST report on de-identification (NISTIR 8053, 2015) and NIST SP 800-188 (2023) describe the resulting practical position: removing names is not enough, re-identification risk must be estimated, and the choice of method should depend on the release model, whether public, restricted or enclave access, as well as on the intended data users.

2.4 Differential privacy

The second family protects the output of an analysis rather than records. Dwork, McSherry, Nissim and Smith (2006) introduced calibrating noise to the sensitivity of a query: if adding or removing one person changes a count by at most one, Laplace noise with scale one over epsilon makes the published count almost equally likely with or without that person. Dwork and Roth (2014) give the formal foundations. The guarantee holds whatever the attacker already knows, which answers the weakness of syntactic models, but it costs accuracy, and the cost is largest for small counts such as quiet stations and rare journeys.

2.5 The gap

Ines finds many theoretical comparisons and many single-method case studies, but few studies that compare both families on the same release, measure risk with the same attack and ask real users whether the result remains useful. That is her gap. Her contribution will be empirical and practical: a controlled comparison on one synthetic transit population, with planners' acceptance as an explicit utility criterion. She writes the gap as a single sentence for her committee and checks it against the falsifiable question from Chapter 1, so that the review and the study design point at exactly the same uncertainty.

Worked example

Ines groups the literature into theory (Warren and Brandeis, Solove, Nissenbaum), syntactic models (Sweeney, l-diversity, t-closeness), attacks (Narayanan and Shmatikov) and differential privacy (Dwork and colleagues), and identifies a gap: same-release comparison with a user utility test.

Synthetic case. Every work named is real and cited in the references; Ines's synthesis is a teaching illustration.

Errors and limits

A literature map simplifies; differential privacy also has variants and attacks on implementations. Contextual integrity is a normative theory, not a metric.

Exercises

EX008 — Contextual integrity. How would contextual integrity judge sending journey data to planners?
Show marking criteria
Rubric: 3 = asks whether the flow fits the norms riders expected when they tapped their cards;; 2 = mentions norms;; 1 = says it is legal;; 0 = none.
EX009 — Solove's groups. Name Solove's four groups of privacy problems.
Show marking criteria
Rubric: 3 = collection, processing, dissemination, invasion;; 2 = names three;; 1 = names one;; 0 = none.
EX010 — l-diversity motive. What weakness of k-anonymity led to l-diversity?
Show marking criteria
Rubric: 3 = a k-anonymous group may share one sensitive value, revealing it for all members;; 2 = mentions sensitive values;; 1 = restates k-anonymity;; 0 = none.
EX011 — Sparse records. Why does the Narayanan and Shmatikov result matter for transit data?
Show marking criteria
Rubric: 3 = journeys are sparse and distinctive like ratings, so a few known trips can link a record;; 2 = says linkage is possible;; 1 = cites a film case only;; 0 = none.
EX012 — Sensitivity meaning. What is the sensitivity of a count query, and why does it matter?
Show marking criteria
Rubric: 3 = the most one person can change it, one; noise scale is sensitivity over epsilon;; 2 = defines sensitivity loosely;; 1 = names epsilon only;; 0 = none.
EX013 — Background knowledge. Which advantage does differential privacy have over syntactic models?
Show marking criteria
Rubric: 3 = its guarantee holds regardless of the attacker's background knowledge;; 2 = mentions attackers;; 1 = says it is newer;; 0 = none.
EX014 — Gap statement. State Ines's research gap in one sentence.
Show marking criteria
Rubric: 3 = few studies compare both families on one release with one attack and a user utility test;; 2 = mentions comparison;; 1 = says more research is needed;; 0 = none.

Synthesis

Chapter 2 maps theory, models, attacks and differential privacy to a precise gap. Chapter 3 turns the gap into a proposal with a generalisation baseline.

Continue studying — chapter 02 of 08

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →