In the preceding chapters, we have analyzed the trade-off between data holders and service users in two different settings. In the two-party case, the trade-off consisted of obtaining a high level of privacy protection from the service provider at the expense of sacrificing some part of the service offering. The more privacy the data holder wants, the less extensive will the service offering of the service provider be.

In the three-party case, the trade-off consisted of reducing the extent and the quality of the service result in terms of marginal information in order to protect the privacy of the data holders. It was possible to increase the privacy protection for the data holders by reducing the extent of the final service result.

This chapter will elaborate on two important aspects of this trade-off. First, we will discuss quantitative aspects. Which models and metrics exist to quantify the conflict? Which mechanisms can lead to an automatic resolution of the conflict? How can these models and mechanisms be applied to our approaches in the two-party and in the three-party case?

Second, we will discuss the qualitative aspect of the privacy trade-off. Why is it important to raise awareness of the conflict? What can be done to increase data holders' willingness to provide data in well-protected environments? What are the implications for electronic commerce and public policy?

Quantification Frameworks in Statistical Disclosure Control

The research field of Statistical Disclosure Control (SDC) has long been concerned with the quantification of the trade-off between data quality for the service users and privacy protection for the data holders. In SDC terminology, the utility to the service users is measured in terms of information loss (IL) compared to the original, unmasked data. The privacy of the data holders is specified in terms of the disclosure risk (DR) that indicates the probability with which confidential information can be inferred.

Measures for information loss

The aim of SDC research is to find an objective measure for information loss. There exists a seminal debate about the question of whether or not information loss should be specified in objective terms. [Domingo-Ferrer, et al., 2001] argue that the information loss depends heavily on the potential uses of the masked data and that these data uses are "so diverse that it is hard to even identify them". Among other reasons, this is in the implementation of the "audit and aggregate" methodology, we chose a categorical hierarchy of data utilities such as the one displayed in Table 4-11.

[Duncan, et al., 2001; Duncan, et al., 2001] propose an information loss criterion for a numerical attribute that assumes value with probability p . They use mean squared precision, i.e. the reciprocal of the mean squared error. For the case where the actual value is equal to 1, the information loss criterion is

(5-1)

where |dom()| denotes the number of possible values .

Measures for disclosure risk

Disclosure risk measures the extent to which confidentiality is protected from the attacks of a data snooper. [Duncan,et al., 2001; Duncan,et al., 2001] use information theory [Shannon, 1948] to quantify disclosure risk. They suggest the reciprocal of the (non-conditional) entropy, where p = is the probability for the intruder that a cell X assumes value . The disclosure risk DR can then be denoted as

(5-2)

[Domingo-Ferrer and Mateo-Sanz, 2002; Domingo-Ferrer,et al., 2001; Domingo-Ferrer, et al., 2002] note the difficulties in computing p because it is necessary to determine the exact information that a snooper holds. They propose to take the conditional entropy

(5-3)

where X is an original cell and Y represents the intruder's knowledge (equal to some y).

The Risk-Utility confidentiality map

[Duncan,et al., 2001] were the first to propose a framework that takes both data utility and disclosure risk into account. They plot a Risk-Utility (R-U) confidentiality map that includes data points for each disclosure limitation method. With each method, a certain level of disclosure risk is incurred for the data holders and a certain level of data utility is achieved for the service users. There are two extreme cases. First, when all information is suppressed, both data utility and disclosure risk are zero. Second, when all information is published without any transformation, then both data utility and disclosure risk are at their respective maximum. Figure 5-1 shows a sample R-U confidentiality map for a specific disclosure limitation method called topcoding.

Figure 5-1: The R-U confidentiality map for the disclosure limitation method
topcoding with varying parameters
Source: [Duncan,et al., 2001]

Topcoding is a disclosure limitation method that protects extreme values within in a range of data points. Consider the case of renters in a specific district with their corresponding contract rents. If, for instance, 1% of the renters pay a contract rent of more than $3000, then a topcoding threshold = $3000 would suppress the release of individual rents above $3000 and only the number of renters and the mean conditional rent in this segment would be given out. A high thus corresponds to a small segment that induces only a little masking. This means high data utility for the users and high disclosure risk for the renters, and is denoted by data points in the upper right of the figure. In contrast, a low threshold indicates that the topcoded segment is very large and that many renters are aggregated in a single value. This means that data utility is low, and that disclosure risk is also minimal. This corresponds to data points in the lower left in Figure 5-1. Note that this map is originally not continuous but a smoothed curve of single data points, i.e. a limited number of topcoding thresholds .

A R-U confidentiality map for Health Maintenance Organizations

We will now apply the concept of the R-U confidentiality map to the healthcare example that we have introduced in Chapter 4. We measure the disclosure risk (DR) for each confidential cell a _ij based on information entropy, as proposed in [Domingo-Ferrer,et al., 2002] where

where |a _ij ^u - a _ij ^l | is the width of the inferred interval and where 1000 |a _ij ^u - a _ij ^l | indicates the number of possible values that can be assumed with a precision of 0.001 (i.e. an interval width of 0.015 is equivalent to 15 assumable values). Referring to our running example from Section 4.1.2, we can calculate the total disclosure risk DR _i that a specific health maintenance organization incurs for all of the tests as follows.

DR _i =

.

Measuring data utility is a more difficult issue as it depends on the goals of the service users. For our purposes, we will derive the data utility of a data dissemination strategy by simply adding up the data utilities in the four information categories. The three dissemination strategies that we are going to evaluate for the R-U confidentiality have the following data utilities.

DS ₁ : a _*,cen :: Arithmetic mean [2], a _*,dis :: Suppression [0], a _cen,* :: Arithmetic mean [2], a _dis,* :: Suppression[0]
DU ₁ = 2+0+2+0= 4

DS ₂ : a _*,cen :: Arithmetic mean [2], a _*,dis :: Min-max skew [1], a _cen,* :: Arithmetic mean [2], a _dis,* :: Suppression[0]
DU ₂ = 2+1+2+0= 5

DS ₃ : a _*,cen :: Arithmetic mean [2], a _*,dis :: Min-max skew [1], a _cen,* :: Arithmetic mean [2], a _dis,* :: Min-max skew [1]
DU ₃ = 2+1+2+1= 6

After determining the inference intervals for these three dissemination strategies, we can calculate the disclosure risks and finally draw the R-U confidentiality for the 4 HMOs. This is illustrated in Figure 5-2.

Figure 5-2: R-U confidentiality maps for all HMOs

This figure illustrates the trade-off between data utility and disclosure risk at HMOs. The greater the utility of the disseminated information for the legitimate service user, the greater also the disclosure risk for the data holders. It also indicates that HMOs do not necessarily "dominate" each other in terms of disclosure risk. For DS₂, HMO₂has higher disclosure risk than HMO₂, but for DS₃ just the opposite is the case. Slight differences in dissemination strategies can have a huge impact on disclosure risk.

Other metrics for data utility are also possible. For example, we could use the reciprocal of the total average relative error TARE that we introduced in Section 4.8.4.1. The specification for data utility would shown below.

DU' =

=

The results are comparable to those depicted in Figure 5-2.

Interpretation of the R-U confidentiality map

The R-U confidentiality map does not only illustrate the trade-off between data holders and service users, it is also a good tool to demonstrate how external effects can change the choice of the optimal dissemination strategy. For the R-U map from the last section, we now introduce the concept of a disclosure risk threshold that indicates the maximum level of risk that the data holders are willing to incur. If the disclosure risk of a dissemination strategy is above the threshold, it is not permissible, see Figure 5-3.

Figure 5-3: Variance of the disclosure risk threshold in the R-U confidentiality map

Now it can easily be seen that for the dissemination strategy DS₂, all HMOs except HMO₄would agree to a publication. Note that this threshold is not necessarily fixed over time. The most likely reason for a variance in the threshold is a change in the environment of the system. For the case of the HMOs, political or public pressure to improve the cooperation with regional healthcare initiatives can increase the disclosure risk threshold. In the case of national security, which we will address in Section 5.2.2.1, extensive data collection to prevent foreseeable threats may also increase the acceptance of higher exposure of personal data, i.e. a higher disclosure risk threshold.

Implications

The lack of awareness of the existing privacy trade-off leads to the choice of extremes from the perspective of the data holders. A survey by [Ackerman,et al., 1999] shows that 17% of all online users are "privacy fundamentalists" who will not provide data to a web site even if privacy protection measures are in place. 27% are "marginally concerned" and generally willing to provide data to web sites without major concerns. The remaining 56% of online users make up the "pragmatic majority" that takes trade-off issues into account and decides on a case by case basis (see Figure 5-4).

Figure 5-4: Privacy attitudes of online users Source: [Ackerman,et al., 1999]

A study by [Fox and Rainie, 2000] indicates that the share of privacy fundamentalists could be as high as 27%. When looking at these figures, one has to take into account that the actual usage behavior often differs from the privacy attitudes that were specified through a survey. [Spiekermann,et al., 2001] found that even privacy fundamentalist divulge very private information once they get involved in a particular online process such as an online purchase. However, Figure 5-4 still suggests that almost the half of all online users tend to extreme usage behavior in regards to privacy issues. One reason for this is the lacking awareness of privacy issues and the insufficient belief in privacy protection mechanisms.

Impact on electronic commerce

In spite of growing efforts to protect privacy in web-based services through technical or legal means, many service users are still very concerned about their personal data. A comprehensive study by [IBM, 1999] shows that up to 54% of Internet users in the U.S. have already refrained from buying online due to privacy concerns. In the ASP market, potential customers still rank privacy and security first among their reasons to reject ASP service offerings [Carter, 2000]. Both for corporate and private customers, privacy concerns seem to be a main obstacle for the participation in the electronic marketplace.

One lever to increase market participation is to make the user interaction more transparent. The hypothesis is that if a user knows what is happening with his data, he is more likely to provide them. The Platform for Privacy Preferences (P3P) initiative [P3P, 2004] is an "industry standard providing a simple, automated way for users to gain more control over the use of personal information on Web sites they visit" and is accepted by web sites on an increasing scale [Ernst & Young, 2003]. It automatically matches the privacy preferences of the service user with the privacy policies of the service provider and gives an alert when the user's privacy requirements are not met. It distinguishes between data-oriented policies and method-oriented policies [Kobsa, 2001].

Another approach is to leave the decision about which data to provide directly to the user (instead of an automated privacy negotiation system). This is of particular interest for user-adaptive systems such as online book stores. These systems "cater to users more effectively the more information they possess about them" [Kobsa, 2002]. This means that the more extensive and accurate the information that the system has about the user, the better the service quality that it can deliver. These "personalized services" can include customized finance pages or news collections, targeted recommendations or advertisements based on past purchase behavior, customized pricing, express transactions or tailored email alerts. In online book stores for instance, these personalized services include highlights of recently published books of interest. The recommendations are based on clicking behavior and on preceding book or CD purchases. Unfortunately, many online stores do not offer an option to (de-)activate the tracking of the click and purchase history and thereby prevent the user from easily trading off his own privacy concerns with the potential benefit from an extended service. An interesting approach that considers both privacy concerns and personalization quality can be found in [Berendt and Teltzrow, 2003].

Implications for public policy

The state also plays a major role in the protection of the personal privacy of its citizens. On the one hand, the state is concerned with the enforcement of privacy protection laws such as ones triggered the EU privacy directives [EU, 1995; EU, 2002] for countries of the European Union or the Healthcare Insurance Portability Accountability Act [HIPAA, 1996] in the USA. On the other hand, the state also has an interest in collecting information about its citizens for administrative reasons or for concerns of national security.

National security

Intelligence agencies that are charged with crime prevention need to collect information about suspiciously behaving subjects. This may include screening confidential phone calls, emails and conversations of innocent bystanders. On that account, the individual citizen sacrifices a part of his own personal privacy to support higher goals of the society, national security in this case. It is a very difficult political question to decide which goals of the society really justify significant intrusions into the privacy of each individual citizen, see e.g. [Economist, 1999; Orwell, 1949; Schily, 2004; Time, 1997; Warren and Brandeis, 1890]. Reducing the personal privacy of citizens must thus be thoroughly justified. In particular, the effectiveness of the actions taken has to be demonstrated, and the risks for innocent bystanders shall beminimized. It is worth noting that changing political and economic situations have a huge impact on the tolerated level of intrusion. The incidents of September 11, 2001 for instance, have lead to the creation of institutions and laws that allow for a significant invasion of the personal privacy of individuals, see [DHS, 2004; IAO, 2003; PATRIOT, 2001]. The temporarily increased desire for national security leads to a general increase in the tolerance of many citizens to be monitored or to provide personal data. The trade-off between each citizen's privacy and the interests of the service users is settled at a lower level of privacy, triggered by the current political situation. Privacy-defending institutions such as the Electronic Privacy Information Center (EPIC) of course protest against this development, see e.g. [EPIC, 2004]. In any case, legislation has to ensure that the shifts in political or economic environments neither eliminate the citizens' privacy nor completely block the activity of the authorities.

Medical research

There are other domains of public interest. Medical researchers for instance need large samples of patient data to investigate the roots of illnesses such as cancer. Precise data about patient characteristics and behavior facilitate the discovery of correlations between patient characteristics, diagnosis and success of treatment. However, whenever a physician forwards confidential patient data to external third parties, misuse at the expense of the patient must be prevented. Again, the protection of personal privacy is diametrically opposed to the pursuit of a societal goal, in this case the investigation of illnesses to improve society health. Legal frameworks have to ensure that a trade-off can be settled such that both the privacy of the patients is preserved and that the published data has a utility for researchers. In the United States, [HIPAA, 1996] requires the removal of a number of personal data fields before release which, reduces its potential utility for the researchers. There is a lot of work required to facilitate high-quality medical research while still protecting the privacy of the patients [Sweeney, 2002].