Privacy Protection in Data Projects

Part 1: What Are We Protecting? Identifying Personal Data

Protecting privacy begins with understanding what information can identify a person. The most obvious identifiers are things like a person's name or social security number. However, the risk often lies in less obvious data points that, when combined, can single out an individual.

To build a robust privacy strategy, we must first classify the data we are handling.

As the guide explains, we can break down identifiers into two main types:

1. Direct Identifiers: Information that on its own identifies a person (e.g., name, address, email). These are usually the first to be removed in any data cleaning process.
2. Indirect Identifiers (or Quasi-Identifiers): Information that, in combination, can identify a person (e.g., age, occupation, geographic location, marital status). This is where the real challenge for statisticians and data managers lies.

Furthermore, some data is so sensitive that it's given a special status. The guide, citing GDPR, calls this Special Category Data. This includes information revealing health status, sex life, or sexual orientation. Both of our core examples fall squarely into this category.

Application to Your Research Contexts

• Bra Design Data: A dataset of anthropometric measurements contains numerous indirect identifiers. While a single measurement like bust_circumference = 95cm is not identifying, the unique combination of bust, underbust, waist, strap length, and torso height could be. When combined with other indirect identifiers like age and town of residence, the risk of re-identification becomes significant. This data can also be considered "data concerning health."

• Polyamorous Relationship Data: Research into relationship dynamics inherently collects "special category data" concerning participants' sex lives and sexual orientation. Indirect identifiers are abundant: the specific structure of the relationship (e.g., a one-female, three-male polyfidelity quad), unique relationship rules, duration of the relationship, and the professions of the members. Even without names, a narrative containing enough of these unique details could make a participant identifiable to their social circle.

Part 2: The Goal of Anonymization

Now that we have identified the risky data, what is our goal? It's not enough to simply remove names. The process of removing direct identifiers is called de-identification. True privacy protection requires anonymization, which is the process of treating indirect identifiers to ensure the risk of re-identifying an individual is negligible.

So, how do we measure "negligible risk"? One of the foundational concepts in this area is k-anonymity. It provides a formal, measurable standard for privacy.

In essence, a dataset has k-anonymity if for any person in the dataset, their combination of indirect identifiers is indistinguishable from at least k-1 other people. The group of k individuals who share the same set of indirect identifiers is called an equivalence class.

Your job as a data manager is to modify the dataset so that you can guarantee a minimum value of k (e.g., k=5, k=10) for all records, depending on the sensitivity of the data and your ethical assessment of the risks.

Part 3: A Toolbox of Anonymization Techniques

How do we achieve k-anonymity? We use various techniques to reduce the specificity of the data, deliberately trading some data precision for a gain in privacy. This is a core task in ethical data handling.

The following resources provide a toolbox of common methods.

Let's synthesize these techniques and see how they apply to our examples.

Methods for Quantitative Data (e.g., Bra Measurement Dataset)

Imagine you have a dataset of 500 participants with precise body measurements, age, and location. To achieve k-anonymity (e.g., k=5), you could apply:

1. Generalization (Banding/Binning): This is the most common technique.
   • Age: Instead of a precise age like 32, you would group it into a band, like 30-34.
   • Measurements: Instead of a measurement to the millimeter like Underbust: 73.4 cm, you could generalize it to a 2cm range, like 73-75 cm.
2. Top/Bottom Coding: This is a special form of generalization for outliers. If one participant has a very rare measurement or is significantly older than everyone else (e.g., age 95), their record is easily identifiable. You could code their age as 80+ to group them with other older participants.
3. Suppression: If a participant has a truly unique combination of attributes that cannot be generalized without destroying the data, you might suppress certain values (replace them with * or NA) or, in extreme cases, remove the entire record (record suppression).

By applying these techniques, an attacker looking for a 32-year-old woman with a 73.4cm underbust in a specific city would fail. Instead, they would find an equivalence class of at least 5 women aged 30-34 in a broader geographic region, making it impossible to single out the individual.

Methods for Qualitative Data (e.g., Polyamory Interview Transcripts)

Anonymizing narrative text is more of an art, but the principles are the same. Your goal is to remove unique details that could act as a "narrative fingerprint."

1. Pseudonymization: This is the first step. All names of people, places, and organizations are replaced with consistent pseudonyms (e.g., "Participant A," "Partner B," "Cityville").
2. Generalization & Categorization: This is the most critical step for narrative data.
   • Occupations: "Senior software engineer at a major tech firm" becomes "works in the tech industry."
   • Locations: "They met at a specific coffee shop in the East Village" becomes "They met at a café downtown."
   • Unique Events: "The argument started after they returned from their trip to Kyoto in May 2022" becomes "The argument started after returning from an international trip."
   • Relationship Rules: A highly specific rule like "Veto power can be invoked via text message but must be followed up with a 30-minute in-person conversation within 48 hours" could be generalized to "The relationship agreement included a process for partners to object to new romantic connections."

By systematically applying these techniques, you strip the narrative of its uniquely identifying characteristics while preserving its thematic content for analysis.

Conclusion

In this lesson, we have moved from the "why" of privacy to the "how." You are now equipped to assess a data project's privacy protections by identifying the types of data at risk and understanding the methods used to mitigate that risk.

Key Takeaways:

• Privacy risk comes from both direct identifiers and, more subtly, combinations of indirect (quasi-) identifiers.
• Data concerning health, sex life, or sexual orientation is Special Category Data requiring the highest level of protection.
• Anonymization is the goal, aiming for a negligible risk of re-identification. k-anonymity provides a formal metric for this, where each individual is indistinguishable from at least k-1 others.
• A toolbox of techniques—including generalization (banding), suppression, and pseudonymization—is used to balance the trade-off between data utility and privacy.

Preview of the Next Lesson:

We have now covered Consent, Transparency, Openness, and Privacy. The fifth element of our CTO POC framework is O for Ownership. In our next lesson, we will tackle the often contentious question: Who owns the data? We will explore the rights and responsibilities of participants, researchers, and institutions, and how data ownership impacts everything from usage rights to long-term data stewardship.