Chapter 8 — Defense and publication plan
Lesson map
Lesson 08 published. Map, example, EX045.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Preparing the defense"]
N2["8.2 The defense"]
N3["8.3 Publication plan"]
N4["8.4 The organisational decision"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX045"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Preparing the defense"]
N2["8.2 The defense"]
N3["8.3 Publication plan"]
N4["8.4 The organisational decision"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX045"]
[Learning outcomes]
|
v
[8.1 Preparing the defense]
|
v
[8.2 The defense]
|
v
[8.3 Publication plan]
|
v
[8.4 The organisational decision]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX045]
Learning outcomes
You will (1) prepare a doctoral defense around evidence and limits; (2) plan publications for distinct audiences; (3) translate findings into an organisational decision.
8.1 Preparing the defense
Ines prepares by listing the hardest questions she expects. Why should a synthetic population be trusted? Is epsilon one per year realistic for daily releases? Would a stronger attacker break the k-anonymous file further? For each she prepares a short answer that points to evidence and a limit. Prof. Aaltonen runs a mock defense in which he plays a hostile examiner, and she learns to answer "I do not know, but here is how I would find out" when the evidence runs out, instead of defending claims her data cannot support in front of the committee.
8.2 The defense
At the defense, the external examiner, a privacy engineer, presses on budget accounting. Ines explains that her study used epsilon one per table, and that a year of daily tables under simple composition would give a much larger total, so the authority must choose a yearly budget and accept larger daily error, or publish less often. The examiner accepts the answer and asks that the thesis state this trade-off in the abstract. The committee passes the thesis with minor corrections, one of which adds a sentence on composition to the abstract and another clarifies the multi-day attack.
8.3 Publication plan
Ines plans three outputs for three audiences. A journal article reports the controlled comparison and the independent validation for researchers. A short practitioner guide explains, without equations, why pseudonymisation is not anonymisation and how to choose between release methods. A briefing for Valemont's board recommends stopping the token-only release and piloting differentially private counts for busy routes, while keeping restricted access for quiet routes. Each output cites the same archive, so readers in every audience can trace claims to the same evidence and examine the code that produced each number.
8.4 The organisational decision
Valemont's board adopts the recommendation. Its data protection officer records the reasoning in the authority's records, with a data protection impact assessment for the new release process, as Article 35 of the GDPR requires where processing is likely to result in a high risk. The board also asks Ines to present the result to other transit authorities. She agrees, but only with the bounded claim and its limits, and she reminds them that their own populations and attackers may differ. Her final reflection is that the thesis changed one real decision because every claim was falsifiable and documented.
Worked example
Ines prepares hard questions, defends a budget-accounting trade-off, plans a journal article, a practitioner guide and a board briefing, and sees Valemont replace token-only releases with a documented differentially private pilot.
Synthetic case. The defense, board and examiner are synthetic; GDPR Articles 25 and 35 are real.
Errors and limits
A successful defense is not proof of universal truth; other authorities must validate in their own context.
Exercises
- EX045 — Unknown answers. How should Ines answer when evidence runs out in a defense? Rubric: 3 = admit the limit and explain how she would find out;; 2 = admits uncertainty;; 1 = defends anyway;; 0 = none.
- EX046 — Yearly budget. What trade-off did the examiner want stated in the abstract? Rubric: 3 = a yearly budget forces larger daily error or less frequent publication;; 2 = mentions composition;; 1 = omits;; 0 = none.
- EX047 — Three audiences. Name Ines's three outputs and audiences. Rubric: 3 = journal article for researchers, guide for practitioners, briefing for the board;; 2 = names two;; 1 = names one;; 0 = none.
- EX048 — Board recommendation. What did the board briefing recommend? Rubric: 3 = stop token-only release, pilot DP counts for busy routes, restricted access for quiet ones;; 2 = two parts;; 1 = one part;; 0 = none.
- EX049 — Article 35 role. Why does the new release process need a DPIA? Rubric: 3 = Article 35 requires one where processing is likely to result in high risk;; 2 = mentions risk;; 1 = says optional;; 0 = none.
- EX050 — Transfer caution. What caution does Ines give other authorities? Rubric: 3 = their populations and attackers may differ, so they must validate locally;; 2 = mentions difference;; 1 = says results transfer;; 0 = none.
Synthesis
Chapter 8 closes the doctoral track with a defended, bounded result and one changed decision. The worked results follow, then the references.
Continue studying — chapter 08 of 08
← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →