METHOD OF RE-IDENTIFICATION RISK MEASUREMENT AND SUPPRESSION ON A LONGITUDINAL DATASET

摘要

In longitudinal datasets, it is usually unrealistic that an adversary would know the value of every quasi-identifier. De-identifying a dataset under this assumption results in high levels of generalization and suppression as every patient is unique. Adversary power gives an upper bound on the number of values an adversary knows about a patient. Considering all subsets of quasi-identifiers with the size of the adversary power is computationally infeasible. A method is provided to assess re-identification risk by determining a representative risk which can be used as a proxy for the overall risk measurement and enable suppression of identifiable quasi-identifiers.

主权项

1. A computer implemented method of re-identification risk measurement of a dataset, the method comprising:
retrieving the dataset comprising personally identifiable information for a plurality of individuals, each individual having cross-sectional (L1) data defining identifiable information and one or more entries of longitudinal (L2) data associated with the L1 data; reducing multiple occurrences for the same individual of the same L2 data to a single feature with an addition of a count; grouping individuals in L1 equivalence classes based on L1 data quasi-identifiers; ordering the features from most to least identifying within each L1 equivalence class; subsampling multiple features for each individual; determining a similarity measure by counting the individuals in the L1 equivalence class who's features comprise a superset of the subsampled features for the current individual; combining multiple similarity measures into a single measure per individual; and determining an overall risk measurement from the combined similarity measures.