Secondary Data Privacy Enforcement Using Anonymization Layers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data privacy enforcement is typically not effective in secondary data systems, as data vended from primary systems often retains sensitive information, exposing it to a larger number of users and systems for extended periods without adequate protection.
Innovation Solution
A data privacy service that implements K-anonymity, L-diversity, and differential privacy modules to scrub identifiers, anonymize quasi-identifiers, and add inert data to ensure compliance, ensuring secure transfer to both trusted and untrusted secondary systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is vended from primary systems to secondary systems, then data availability and accessibility are improved, but data privacy and security are compromised
Solution Approach 1:
The system performs preliminary data anonymization and privacy constraint application before data is vended to secondary systems. The data privacy service scrub identifiers and anonymize quasi-identifiers in advance, ensuring that even if data is accessed by multiple users over extended periods, the privacy damage is already mitigated before the data leaves the primary system.
Solution Approach 2:
The data privacy service acts as an intermediary between primary and secondary systems. It receives data from primary systems, applies privacy constraints and anonymization transformations, then vendors the protected data to secondary systems. This intermediary layer ensures privacy enforcement mechanisms travel with the data, protecting it during transit and storage in secondary systems.
2Productivity
If data is transferred to secondary systems without privacy enforcement, then data utility and analytical value are improved, but compliance with privacy constraints deteriorates
Solution Approach 1:
The system transforms data parameters through anonymization techniques while preserving analytical utility. Identifiers are scrubbed and quasi-identifiers are anonymized, changing the data's identifying characteristics while maintaining its statistical and analytical properties. This allows secondary systems to perform business intelligence operations while complying with privacy constraints.
3Object-affected harmful factors
If identifiers and quasi-identifiers are scrubbed from data, then data privacy is improved, but data accuracy and identifiability deteriorate
Solution Approach 1:
The data privacy service extracts and removes identifiers from the dataset, separating the privacy-risk elements from the analytically valuable data. This extraction process scrubs direct identifiers while preserving the remaining data structure and relationships, allowing analysis without direct identification capability.
Solution Approach 2:
The system creates anonymized copies of the original data for secondary system distribution. These copies contain the same analytical information but with identifiers removed or transformed. The anonymization process creates a surrogate version that maintains statistical properties while eliminating direct identification pathways.
Data Source
AI summary
Systems and methods are described relating to enforcing privacy constraints when data is transferred between data systems. In some examples, a request to transfer a dataset from a primary data system to a secondary data system may be obtained. A set of privacy policies May be enforced on the dataset to generate a modified dataset by performing one or more of: modifying values of quasi-identifiers (values that do not individually, uniquely identify a user) identified in the dataset such that the dataset satisfies one or more of an anonymity or a diversity test; or introducing inert data into the dataset to meet a differential privacy criteria, where the amount of inert data is generated based at least in part on the one or more quasi-identifiers in the dataset. The service may then cause the modified dataset to be accessible by the secondary data system.