Towards formalizing the GDPR's notion of singling out

Aloni Cohen, Kobbi Nissim

Research output: Contribution to journalArticlepeer-review

15 Scopus citations

Abstract

There is a significant conceptual gap between legal and mathematical thinking around data privacy. The effect is uncertainty as to which technical offerings meet legal standards. This uncertainty is exacerbated by a litany of successful privacy attacks demonstrating that traditional statistical disclosure limitation techniques often fall short of the privacy envisioned by regulators. We define “predicate singling out,” a type of privacy attack intended to capture the concept of singling out appearing in the General Data Protection Regulation (GDPR). An adversary predicate singles out a dataset x using the output of a data-release mechanism M(x) if it finds a predicate p matching exactly one row in x with probability much better than a statistical baseline. A data-release mechanism that precludes such attacks is “secure against predicate singling out” (PSO secure). We argue that PSO security is a mathematical concept with legal consequences. Any data-release mechanism that purports to “render anonymous” personal data under the GDPR must prevent singling out and, hence, must be PSO secure. We analyze the properties of PSO security, showing that it fails to compose. Namely, a combination of more than logarithmically many exact counts, each individually PSO secure, facilitates predicate singling out. Finally, we ask whether differential privacy and kanonymity are PSO secure. Leveraging a connection to statistical generalization, we show that differential privacy implies PSO security. However, and in contrast with current legal guidance, kanonymity does not: There exists a simple predicate singling out attack under mild assumptions on the k-anonymizer and the data distribution.

Original languageEnglish
Pages (from-to)8344-8352
Number of pages9
JournalProceedings of the National Academy of Sciences of the United States of America
Volume117
Issue number15
DOIs
StatePublished - 14 Apr 2020
Externally publishedYes

Keywords

  • Differential privacy
  • GDPR
  • K-anonymity
  • Privacy
  • Singling out

ASJC Scopus subject areas

  • General

Fingerprint

Dive into the research topics of 'Towards formalizing the GDPR's notion of singling out'. Together they form a unique fingerprint.

Cite this