Protecting Privacy Using k-Anonymity

Journal of the American Medical Informatics Association

Volumn 15, Issue 5, 2008, Pages 627-637

  El Emam, Khaled ^a,b   Dankar, Fida Kamal ^a  

^a CHILDREN S HOSPITAL OF EASTERN ONTARIO   (Canada)

^b UNIVERSITY OF OTTAWA   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

ARTICLE; CLINICAL RESEARCH; COMPUTER MODEL; COMPUTER SIMULATION; HYPOTHESIS; K ANONYMITY; MEDICAL INFORMATION; PRACTICE GUIDELINE; PRIVACY; PROBABILITY; PROFESSIONAL SECRECY; REFERENCE DATABASE; RESEARCH ETHICS; RESEARCH SUBJECT; RISK ASSESSMENT; RISK REDUCTION;

ALGORITHMS; COMPUTER SECURITY; COMPUTER SIMULATION; CONFIDENTIALITY; HUMANS; INFORMATION STORAGE AND RETRIEVAL; MEDICAL RECORDS SYSTEMS, COMPUTERIZED; ONTARIO; RISK; RISK MANAGEMENT;

EID: 49249103738     PISSN: 10675027     EISSN: None     Source Type: Journal    
DOI: 10.1197/jamia.M2716     Document Type: Article

References (107)

1. Fienberg S., Martin M., and Straf M. Sharing Research Data (1985), Committee on National Statistics, National Research Council
2. Hutchon D. Publishing raw data and real time statistical analysis on e-journals. Br Med J 322 3 (2001) 530
3. Are journals doing enough to prevent fraudulent publication?. Can Med Assoc J 174 4 (2006) 431. http://www.cmaj.ca/cgi/content/full/174/4/431/ Available at http://www.cmaj.ca/cgi/content/full/174/4/431/. Accessed July 24, 2008.
4. Abraham K. Microdata access and labor market research: The US experience. Allegmeines Statistisches Archiv 89 (2005) 121-139
5. Vickers A. Whose data set is it anyway?. Sharing raw data from randomized trials. Trials 7 15 (2006)
6. Altman D., and Cates C. Authors should make their data available. BMJ 323 (2001) 1069
7. Delamothe T. Whose data are they anyway. BMJ 312 (1996) 1241-1242
8. Smith G.D. Increasing the accessibility of data. BMJ 308 (1994) 1519-1520
9. Commission of the European Communities. On scientific information in the digital age: Access, dissemination and preservation (2007)
10. Lowrance W. Access to collections of data and materials for health research: A report to the Medical Research Council and the Wellcome Trust (2006), Medical Research Council and the Wellcome Trust
11. Yolles B., Connors J., and Grufferman S. Obtaining access to data from government-sponsored medical research. NEJM 315 26 (1986) 1669-1672
12. Hogue C. Ethical issues in sharing epidemiologic data. J Clin Epidemiol 44 Suppl. I (1991) 103S-107S
13. Hedrick T. Jutsifications for the sharing of social science data. Law and Human Behavior 12 2 (1988) 163-171
14. Mackie C., and Bradburn N. Improving access to and confidentiality of research data: Report of a workshop (2000), The National Academies Press
15. Arzberger P., Schroeder P., Bealieu A., et al. Promoting access to public research data for scientific, economic, and social development. Data Science Journal 3 29 (2004) 135-152
16. Wager L., and Krieza-Jeric K. Report of public reporting of clinical trial outcomes and results (PROCTOR) meeting (2008), Canadian Institutes of Health Research
17. Organisation for Economic Co-operation and Development. Science, Technology and Innovation for the 21st Century 2004.
18. Organisation for Economic Co-operation and Development. Promoting Access to Public Research Data for Scientific, Economic, and Social Development: OECD Follow Up Group on Issues of Access to Publicly Funded Research Data 2003.
19. Commission regulation (EC) No 831/2002 o1 17 May 2002 on implementing council regulation (EC) No 322/97 on community statistics, concerning access to confidential data for scientific purposes. Official Journal of the European Communities 2002.
20. Kirwan J. Making original data from clinical studies available for alternative analysis. The Journal of Rheumatology 24 5 (1997) 822-825
21. Chalmers I., and Altman D. How can medical journals help prevent poor medical research?. Some opportunities presented by electronic publishing. The Lancet 353 (1999) 490-493
22. Eysenbach G., and Sa E.-R. Code of conduct is needed for publishing raw data. BMJ 323 (2001) 166
23. Canadian Institutes of Health Research. Policy on access to research outputs (2007). http://www.webcitation.org/5XgxgoBzj Archived at: http://www.webcitation.org/5XgxgoBzj
24. Medical Research Council. MRC Policy on Data Sharing and Preservation 2006.
25. Economic and Social Research Council. ESRC Research Funding Guide 2008.
26. ERC Scientific Council Guidelines for Open Access. European Research Council 2007.
27. National Institutes of Health. Final NIH statement on sharing research data National Institutes of Health. Available at: http://grants.nih.gov/grants/guide/notice-files/not-od-03-032.html. Accessed July 24, 2008.
28. Cecil J., and Boruch R. Compelled disclosure of research data: An early warning and suggestions for phsycologists. Law and Human Behavior 12 2 (1988) 181-189
29. Hansell S. AOL Removes Search Data on Group of Web Users New York Times. 8 August, 2006.
30. Barbaro M, Zeller Jr. T. A Face Is Exposed for AOL Searcher No. 4417749 New York Times. 9 August, 2006.
31. Zeller Jr. T. AOL Moves to Increase Privacy on Search Queries. New York Times. August 22, 2006.
32. Ochoa S., Rasmussen J., Robson C., and Salib M. Reidentification of individuals in Chicago's homicide database: A technical and legal study (2001), Massachusetts Institute of Technology
33. Narayanan A., and Shmatikov V. Robust de-anonymization of large datasets (how to break anonymity of the Netflix prize dataset) (2008), University of Texas at Austin
34. Sweeney L. Computational disclosure control: A primer on data privacy protection (2001), Massachusetts Institute of Technology
35. The Southern Illinoisan v. Department of Public Health. Appelate Court of Illinois, Fifth District, 2004(No. 5-02-0836).
36. The Supreme Court of the State of Illionois. Southern Illinoisan vs. The Illinois Department of Public Health 2006.
37. Federal Court (Canada). Mike Gordon vs. The Minister of Health: Affidavit of Bill Wilson 2006.
38. Cavoukian A. Privacy concerns in preventing fraudulent publication. CMAJ 175 1 (2006) 61-62
39. Samarati P., and Sweeney L. Protecting privacy when disclosing information: k-anonymity and its enforcement through generalisation and suppression (1998), SRI International
40. Samarati P. Protecting respondents' identities in microdata release. IEEE Transactions on Knowledge and Data Engineering 13 6 (2001) 1010-1027
41. Sweeney L. k-anonymity: a model for protecting privacy. International Journal on Uncertainty, Fuzziness and Knowledge-based Systems 10 5 (2002) 557-570
42. Ciriani V., De Capitani di Vimercati S.S.F., and Samarati P. k-Anonymity (2007), Secure Data Management in Decentralized Systems, Springer
43. Sweeney L. Achieving k-anonymity privacy protection using generalization and suppression. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems 10 5 (2002) 571-588
44. Bayardo R., and Agrawal R. Data Privacy through Optimal k-Anonymization Proceedings of the 21st International Conference on Data Engineering (2005) 217-228
45. Iyengar V. Transforming data to satisfy privacy constraints. Proceedings of the ACM SIGKDD Int Conf Data Mining Knowledge Discov (2002) 279-288
46. Purdham K., and Elliot M. A case study of the impact of statistical disclosure control on data quality in the individual UK Samples of Anonymized Records. Env Planning 39 (2007) 1101-1118
47. Fefferman N., O'Neil E., and Naumova E. Confidentiality and confidence: Is data aggregation a means to achieve both. J Public Health Pol 16 (2005) 430-449
48. Ohno-Machado L., Vinterbo S., and Dreiseitl S. Effects of data anonymization by cell suppression on descriptive statistics and predictive modeling performance. J Am Med Inform Assoc 9 6 (2002) s115-s119
49. Kamlet M.S., Klepper S., and Frank R. Mixing micro and macro data: Statistical issues and implication for data collection and reporting. Proceedings of the 1985 Public Health Conference on Records and Statistics (1985)
50. Clause S., Triller D., Bornhorst C., Hamilton R., and Cosler L. Conforming to HIPAA regulations and compilation of research data. Am J Health-Sys Pharm 61 (2004) 1025-1031
51. Abrahamowicz M., du Berger R., Krewski D., Burnett R., Bartlett G., Tamblyn R., and Leffondre K. Bias due to aggregation of individual covariates in the Cox regression model. Am J Epidemiol 160 7 (2004) 696-706
52. Marsh C., Skinner C., Arber S., Penhale B., Openshaw S., Hobcraft J., Lievesley D., and Walford N. The case for samples of anonymized records from the 1991 census. J Royal Statist Soc, Ser A (Statistics in Society) 154 2 (1991) 305-340
53. Elliot M., and Dale A. Scenarios of attack: the data intruders perspective on statistical disclosure risk. Netherlands Official Statistics 14 Spring (1999) 6-10
54. de Waal A., and Willenborg L. A view on statistical disclosure control for microdata. Surv Methodol 22 1 (1996) 95-103
55. Greenberg B., and Voshell L. Relating risk of disclosure for microdata and geographic area size. Proceedings of the Section on Survey Research Methods, American Statistical Association (1990) 450-455
56. Willenborg L., and de Waal T. Elements of Statistical Disclosure Control (2001), Springer-Verlag
57. Benedetti R, Franconi L. Statistical and technological solutions for controlled data dissemination, Proceedings of New Techniques and Technologies for Statistics (vol. 1), 1998;225-32.
58. El Emam K., Jabbouri S., Sams S., Drouet Y., and Power M. Evaluating common de-identification heuristics for personal health information. J Med Internet Res 8 4 (2006) e28
59. Bell S. Alleged LTTE front had voter lists (2006), National Post July 22
60. Bell S. Privacy chief probes how group got voter lists (2006), National Post July 25
61. Freeze C, Clark C. Voters lists 'most disturbing' items seized in Tamil raids, documents say. Globe and Mail. May 7, 2008. Available at: http://www.theglobeandmail.com/servlet/story/RTGAM.20080507.wxtamilssb07/BNStory/National/home. Archived at: http://www.webcitation.org/5Xe4UWJKP.
62. Benedetti R., Capobianchi A., and Franconi L. Individual risk of disclosure using sampling design information (2003), Istituto nazionale di statistica (Italy)
63. Polettini S. Some remarks on the individual risk methodology (2003), Joint ECE/Eurostat working session on statistical data confidentiality
64. Polettini S., and Stander J. A Bayesian hierarchical model approach to risk estimation in statistical disclosure limitation. Privacy in Statistical Databases (2004) 247-261
65. Di Consiglio L, Franconi L. Assessing individual risk of disclosure: An experiment. Joint ECE/Eurostat working session on statistical data confidentiality, 2003.
66. Rinott Y. On models for statistical disclosure risk estimation. Joint ECE/Eurostat Working Session on Statistical Data Confidentilaity 2003.
67. Capobianchi A, Polettini S, Lucarelli M. Strategy for the implementation of individual risk methodology in mu-argus: Independent units. Computational Aspects of Statistical Confidentiality (CASC) Project 2001.
68. Hundepool A, Wetering A, Ramaswamy R, Franconi L, Polettini S, Capobianchi A, Wolf P, Dominigo J, Torra V, R B, Giessing S. mu-Argus User Manual: Version 4.0.
69. Hundepool A. The ARGUS software. Joint ECE/Eurostat Working Sessionon Statistical Data Confidentiality 2003.
70. Franconi L, Polettini S. Individual risk estimation in mu-Argus: A review. Privacy in Statistical Databases, 2004;262-72.
71. Pannekoek J. Statistical methods for some simple disclosure limitation rules. Statistica Neerlandica 53 1 (1999) 55-67
72. Cameron A., and Trivedi P. Regression Analysis of Count Data (1998), Cambridge University Press
73. Long S. Regression Models for Categorical and Limited Dependent Variables (1997), Sage Publications
74. Duncan G., Jabine T., and de Wolf S. Private Lives and Public Policies: Confidentiality and Accessibility of Government Statistics (1993), National Academies Press
75. Cancer Care Ontario Data Use and Disclosure Policy. Cancer Care Ontario 2005.
76. Security and confidentiality policies and procedures. Health Quality Council 2004.
77. Privacy code. Health Quality Council 2004.
78. Privacy code. Manitoba Center for Health Policy 2002.
79. Subcommittee on Disclosure Limitation Methodology - Federal Committee on Statistical Methodology. Working paper 22: Report on statistical disclosure control. Office of Management and Budget 1994.
80. Statistics Canada. Therapeutic abortion survey. 2007. Archived at: http://www.statcan.ca/cgi-bin/imdb/p2SV.pl?Function=getSurvey&SDDS=3209&lang=en&db=IMDB&dbg=f&adm=8&dis=2#b9 Accessed July 24, 2008.
81. College of Physicians and Surgeons of Ontario. Doctor Search. http://www.cpso.on.ca/Doctor_Search/dr_srch_hm.htm Accessed July 24, 2008
82. Paralyzed Veterans Association. http://kdd.ics.uci.edu/databases/kddcup98/kddcup98.html Accessed July 24, 2008
83. Department of Transportation. Fatal crash information. ftp://ftp.nhtsa.dot.gov/FARS/ Accessed July 24, 2008
84. Sweeney L. Uniqueness of Simple Demographics in the US Population (2000), Laboratory for International Data Privacy, Carnegie Mellon University
85. El Emam K, Jonker E, Sams S, Neri E, Neisa A, Gao T, Chowdhury S, Pan-Canadian De-Identification Guidelines for Personal Health Information. Report prepared for the Office of the Privacy Commissioner of Canada, 2007. Available at: http://www.ehealthinformation.ca/documents/OPCReportv11.pdf. Archived at: http://www.webcitation.org/5Ow1Nko5C.
86. LeFevre K, DeWitt D, Ramakrishnan R. Mondrian multidimensional k-anonymity. Proceedings of the 22nd International Conference on Data Engineering, 2006.
87. Hore B., Jammalamadaka R., and Mehrotra S. Flexible anonymization for privacy preserving data publishing: A systematic search based approach (2007), Proceedings of SIAM International Conference on Data Mining
88. Xu J., Wang W., Pei J., Wang X., Shi B., and Fu A. Utility-based anonymization for privacy preservation with less information loss. ACM SIGKDD Explorations Newsletter 8 2 (2006) 21-30
89. Nergiz M., and Clifton C. Thoughts on k-anonymization (2006), Second Intenational Workshop on Privacy Data Management
90. Polettini S. A note on the individual risk of disclosure (2003), Istituto nazionale di statistica (Italy)
91. Machanavajjhala A., Gehrke J., Kifer D., and Venkitasubramaniam M. L-Diversity: Privacy Beyond k-Anonymity (2006), International Conference on Data Engineering
92. Little R., and Rubin D. Statistical Analysis With Missing Data (1987), John Wiley & Sons
93. Vach W., and Blettner M. Biased estimation of the odds ratio in case-control studies due to the use of ad hoc methods of correcting for missing values for confounding variables. Am J Epidemiol 134 8 (1991) 895-907
94. Kim J., and Curry J. The treatment of missing data in multivariate analysis. Soc Methods Res 6 (1977) 215-240
95. Willenborg L., and de Waal T. Statistical Disclosure Control in Practice (1996), Springer-Verlag
96. Bethlehem J., Keller W., and Pannekoek J. Disclosure control of microdata. J Am Stat Assoc 85 409 (1990) 38-45
97. Skinner C., and Holmes D. Estimating the re-identification risk per record in microdata. J Off Stat 14 4 (1998) 361-372
98. Chen G., and Keller-McNulty S. Estimation of identification disclosure risk in microdata. J Off Stat 14 1 (1998) 79-95
99. Zayatz L. Estimation of the percent of unique population elements on a microdata file using the sample (1991), US Bureau of the Census
100. Greenberg B., and Voshell L. The geographic component of disclosure risk for microdata (1990), Bureau of the Census
101. Willenborg L, Mokken R, Pannekoek J, Microdata and disclosure risks. Proceedings of the Annual Research Conference of US Bureau of the Census, 1990;167-180.
102. Skinner G., and Elliot M. A measure of disclosure risk for microdata. J Royal Stat Soc (Ser B) 64 Part 4 (2002) 855-867
103. Aggarwal C. On k-anonymity and the curse of dimensionality. Proceedings of the 31st VLDB Conference (2005)
104. Du Y, Xia T, Tao Y, Zhang D, Zhu F. On Multidimensional k-Anonymity with Local Recoding Generalization. IEEE 23rd International Conference on Data Engineering, 2007;1422-4.
105. Xu J., Wang W., Pei J., Wang X., Shi B., and Fu A. Utility-based anonymization using local recoding (2006), ACM SIGKDD International Conference on Knowledge Discovery and Data Mining
106. Wong R., Li J., Fu A., and Wang K. (alpa,k)-Anonymity: An enhanced k-anonymity model for privacy-preserving data publishing (2006), ACM SIGKDD International Conference on Knowledge Discovery and Data Mining
107. Aggarwal G., Feder T., Kenthapadi K., Motwani R., Panigrahy R., Thomas D., and Zhu A. Approximation algorithms for k-anonymity. J Priv Technol (2005)