Most methods in the literature on synthetic microdata (individual records) generation are parametric, that is, they require knowing or estimating the joint or the conditional distribution of the original microdata. This may be a significant hurdle unless the original microdata are multivariate normal. We propose a rank-based approach to generating synthetic microdata based on the permutation paradigm. We present three different methods and we analyze the utility and the confidentiality they afford. The third method is actually an extension of the second method that adds$k$-anonymity protection against reidentification to the confidentiality against attribute disclosure offered by the first two methods. Our algorithms only require the identification of themarginaldistributions of attributes and yield synthetic attributes that replicate the relationships between the original attributes exclusively based on ranks. This proposal is especially attractive for non-normal or multi-type microdata.

Anonymization for privacy-preserving data publishing, also known as statistical disclosure control (SDC), can be viewed under the lens of the permutation model. According to this model, any SDC method for individual data records is functionally equivalent to a permutation step plus a noise addition step, where the noise added is marginal, in the sense that it does not alter ranks. Here, we propose metrics to quantify the data confidentiality and utility achieved by SDC methods based on the permutation model. We distinguish two privacy notions: in our work, anonymity refers to subjects and hence mainly to protection against record re-identification, whereas confidentiality refers to the protection afforded to attribute values against attribute disclosure. Thus, our confidentiality metrics are useful even if using a privacy model ensuring an anonymity level ex ante. The utility metric is a general-purpose metric that can be conveniently traded off against the confidentiality metrics, because all of them are bounded between 0 and 1. As an application, we compare the utility-confidentiality trade-offs achieved by several anonymization approaches, including privacy models (k-anonymity and ε-differential privacy) as well as SDC methods (additive noise, multiplicative noise and synthetic data) used without privacy models.

Commercial organizations and government agencies that gather, store, share and disseminate data are facing increasing concerns over individual privacy and confidentiality. Confidential data is often masked in the database or prior to release to a third party, through methods such as data perturbation. In this study, re-identification risks of three major additive data perturbation techniques were compared using two different record linkage techniques. The results suggest that re-identification risk of Kim's multivariate noise addition method is similar to that of simple noise addition method. The general additive perturbation method (GADP) has the lowest re-identification risk and therefore provides the highest level of protection. The study also suggests that Fuller's method of assessing re-identification risk may be better suited than the probabilistic record-linkage method of Winkler, for numeric data. The results of this study should be help organizations and government agencies choose an appropriate additive perturbation technique.

Government agencies and other organizations commonly release or share microdata for purposes of analysis. In many cases, microdata release needs to preserve the privacy of individuals and/or sensitive attributes. Current measures of privacy of released microdata are often based on empirical assessments of identity and value disclosure. The disadvantage of empirical assessments of privacy is that their results cannot be generalized with confidence across datasets or protection methods. While theoretical definitions of privacy are available for other methods of data release such as query-response output perturbation systems, they are unsuitable for the microdata release context. This study proposes a theoretical basis for measuring privacy in the microdata release context based on statistical dependence. Using this theoretical basis, we develop practical privacy measures that possess several desirable properties, including generalizability. We illustrate the conceptual benefits of this approach and also show that a privacy measure based on statistical dependence can be used effectively for assessing privacy in microdata

Statistical databases often use random data perturbation (RDP) methods to protect against disclosure of confidential numerical attributes. One of the key requirements of RDP methods is that they provide the appropriate level of security against snoopers who attempt to obtain information on confidential attributes through statistical inference. In this study, we evaluate the security provided by three methods of perturbation. The results of this study allow the database administrator to select the most effective RDP method that assures adequate protection against disclosure of confidential information.