data anonymization

**Data anonymization** is the process of **removing or modifying personally identifiable information (PII)** from datasets so that individuals cannot be identified from the remaining data. It is a fundamental privacy protection technique required by regulations like **GDPR**, **HIPAA**, and **CCPA**. **Anonymization Techniques** - **Suppression**: Remove identifying fields entirely (delete name column, SSN column). - **Generalization**: Replace specific values with broader categories — exact age → age range (30–39), full address → zip code prefix. - **Pseudonymization**: Replace identifiers with artificial pseudonyms (real names → random IDs). Reversible with a key, so technically **not full anonymization** under GDPR. - **Data Masking**: Replace sensitive values with realistic but fake values — real SSN → fake SSN with valid format. - **Perturbation**: Add random noise to numerical values (age ± 2 years, income ± 10%). - **Swapping**: Exchange values between records so individual-level associations are broken while aggregate statistics are preserved. **Key Privacy Concepts** - **k-Anonymity**: Each record is indistinguishable from at least **k-1 other records** based on quasi-identifiers. Prevents singling out individuals. - **l-Diversity**: Within each k-anonymous group, the sensitive attribute has at least **l distinct values**. Prevents learning sensitive attributes from group membership. - **t-Closeness**: The distribution of sensitive attributes within each group is close to the overall distribution. Strongest of the three. **Challenges** - **Re-Identification Attacks**: Famously, Netflix viewing data, AOL search logs, and NYC taxi data were all **re-identified** despite anonymization efforts. - **Background Knowledge**: Attackers with external knowledge can link supposedly anonymous records to individuals. - **Utility Loss**: Aggressive anonymization can destroy the patterns needed for useful analysis. **Anonymization vs. Differential Privacy** Traditional anonymization provides **heuristic** privacy protection and has been repeatedly broken. **Differential privacy** provides **mathematical, provable** guarantees. Modern best practice increasingly favors DP over traditional anonymization for sensitive data.