First, let’s generate some (synthetic) data we can use to help illustrate these concepts.

library(tidyverse)

df <- tibble(
  name = c("Ada Lovelace", "Sophie Germain", "Carl Gauss", "Leonhard Euler"),
  age = c(36, 55, 61, 76),          
  height_cm = c(160, 173, 182, 185)  
)

df

# A tibble: 4 × 3
  name             age height_cm
  <chr>          <dbl>     <dbl>
1 Ada Lovelace      36       160
2 Sophie Germain    55       173
3 Carl Gauss        61       182
4 Leonhard Euler    76       185

Suppression

Suppression Example

df_suppressed <- df |>
  select(-name)

df_suppressed

# A tibble: 4 × 2
    age height_cm
  <dbl>     <dbl>
1    36       160
2    55       173
3    61       182
4    76       185

Generalization

Here we will show an example of generalization on the age column:

df_generalized <- df |>
  mutate(age_group = case_when(
    age < 60 ~ "under 60",
    TRUE     ~ "60+"
  ))|>
  select(-age)

df_generalized

# A tibble: 4 × 3
  name           height_cm age_group
  <chr>              <dbl> <chr>    
1 Ada Lovelace         160 under 60 
2 Sophie Germain       173 under 60 
3 Carl Gauss           182 60+      
4 Leonhard Euler       185 60+      

Replacement

Creating Pseudonyms

Replacement with Pseudonyms

df_pseudonymized <- df |>
  mutate(pseudonym = paste0("ID", row_number())) |>
  select(pseudonym, everything(), -name)

df_pseudonymized

# A tibble: 4 × 3
  pseudonym   age height_cm
  <chr>     <dbl>     <dbl>
1 ID1          36       160
2 ID2          55       173
3 ID3          61       182
4 ID4          76       185

Hashing

• Hashing converts names into fixed-length, irreversible strings.
• Unlike pseudonyms, hashed values cannot be easily reversed.
• In R, we can use the digest package (and function) to hash.

Top- and Bottom-Coding

Top-coding example

• Suppose 6ft (182.88cm) is considered our maximum height threshold:

df_top_coded <- df |>
  mutate(height_cm = if_else(height_cm > 182.88, 182.88, height_cm))

df_top_coded

# A tibble: 4 × 3
  name             age height_cm
  <chr>          <dbl>     <dbl>
1 Ada Lovelace      36      160 
2 Sophie Germain    55      173 
3 Carl Gauss        61      182 
4 Leonhard Euler    76      183.

Adding Noise

• Introduces randomness to protect sensitive info
• Examples:
  • Add a small random amount to numeric values
  • Blur images or alter voices

Adding Noise to Height

set.seed(200) 

df_noisy <- df |>
  mutate(height_cm_noisy = height_cm + rnorm(n(), mean = 0, sd = 2)) |>
    select(-height_cm)

df_noisy

# A tibble: 4 × 3
  name             age height_cm_noisy
  <chr>          <dbl>           <dbl>
1 Ada Lovelace      36            160.
2 Sophie Germain    55            173.
3 Carl Gauss        61            183.
4 Leonhard Euler    76            186.

Permutation

Permutation of Height Values

set.seed(200)

df_permuted <- df |>
  mutate(height_cm_permuted = sample(height_cm)) |>
    select(-height_cm)

df_permuted

# A tibble: 4 × 3
  name             age height_cm_permuted
  <chr>          <dbl>              <dbl>
1 Ada Lovelace      36                173
2 Sophie Germain    55                185
3 Carl Gauss        61                160
4 Leonhard Euler    76                182

Privacy vs. Utility Tradeoff

https://www.researchgate.net/figure/Trade-off-between-privacy-level-and-utility-level-of-data_fig1_357987903

Case Study: Brogan Inc. and NIHB Data

• The Non-Insured Health Benefits (NIHB) database contains sensitive health data on First Nations use of services like prescriptions, dental care, and medical devices.
• In 2001, Health Canada began releasing de-identified NIHB pharmacy claims data to Brogan Inc. (a private health consulting firm).
• Though personal identifiers were removed, community identifiers remained, and First Nations were not informed until 2007.
• Brogan sold the data to pharmaceutical companies for commercial research and marketing
• Health Canada justified the release by claiming no privacy interests remained since personally identifying information had been removed.

Kukutai, T., & Taylor, J. (2016). Indigenous data sovereignty: Toward an agenda. ANU press.

Discussion

• What are the limits of simply removing names and IDs from a dataset?
• How can we measure whether a dataset is truly “safe” to release?
• Should de-identified data still require community consent before being shared or sold?

Why basic deidentification isn’t always enough

• Individuals can often be re-identified using other information.

• As datasets become more detailed and linkable, privacy risks increase.

• De-identification may protect individuals but not groups and even “anonymous” data can reveal sensitive patterns about communities.

• More advanced statistical methods are often needed to ensure meaningful deidentification while preserving data utility.

Statistical approaches to deidentification

• \(k\)-anonymity
  
• \(l\)-diversity
  
• Differential privacy (advanced)

Overview of privacy models

• \(k\)-anonymity and \(l\)-diversity are statistical approaches that quantify the level of identifiability within a tabular dataset.
  
• They focus on how variables combined can lead to identification.
  
• They work best on relatively large datasets, where enough observations are present to preserve useful detail while still protecting privacy.

Identifiers, Quasi-Identifiers, and Sensitive Attributes

Privacy models distinguish between three types of variables:

\(k\)-anonymity

Choosing \(k\)

• There is no single correct value for \(k\)!
• Higher \(k\) increases privacy, but reduces data detail and utility.
  
• The choice depends on promises made to data subjects and acceptable risk levels.

Example data

• Age and city are quasi-identifiers, and salary is considered a sensitive attribute.

\(k=2\)

Given the data and treating condition as the sensitive attribute, which field(s) could you generalize to help achieve \(k = 3\) anonymity?

• A. Generalize Age into age ranges (e.g., 20–29, 40–49)
  
• B. Suppress Condition entirely
  
• C. Generalize ZIP Code to first 3 digits (e.g., 130, 148)
  
• D. Generalize Age into age ranges (e.g., 20–29, 40–49) and ZIP code to first 3 digits (e.g., 130, 148)
  
• E. It’s already \(k=3\) anonymous

\(l\)-diversity

• But what if all individuals within a group share the same sensitive value?

• \(l\)-diversity is an extension of \(k\)-anonymity that ensures sufficient variation in a sensitive attribute.

• Although these data are \(2\)-anonymous, we can still infer that any 30-39 year old from Calgary who participated earns between 90-99k.

\(l\)-diversity

• The approach requires at least \(l\) different values for the sensitive attribute within each combination of quasi-identifiers.
• Again, there is no perfect value for \(l\) (typically \(1< l \leq k\)).

• With \(l=2\), that means that for each combination of Age Range and City, there are at least 2 distinct Salary Ranges.

There are still issues…

• Even though the data is de-identified, some sensitive patterns can still leak through.

• In the example we discussed, both individuals are grouped into the same age range and city.

• While they are in different salary ranges and exact values are hidden, the range is still quite narrow.

• Due to the similarity of the salary ranges, one can still infer that both individuals earn between $90,000 and $119,999.

Differential privacy

• So, we may need more sophisticated tools to privatize our data…
• Differential privacy is a mathematical approach to protecting privacy
• It ensures algorithm results are nearly the same whether one person’s data is included or not
• Differential privacy makes it hard to tell if any individual’s data is in the dataset, which protects individual’s information (even with unusual or unique data)

Open Science

What are Open Data?

Why Open Data Matters

Data Ownership & Licensing

• Understanding data ownership is essential before sharing or licensing data.
  
• Ownership depends on factors like:
  • Who collected or created the data.
    
  • Institutional policies and employment contracts.
    
  • Funding agency requirements and agreements.
    
  • The nature of the data - personal data may be subject to privacy laws (refer back to the Amazon example).

Balancing Openness & Ethics

Key Takeaways

• Data exists on a spectrum of identifiability
• Even seemingly anonymous data can often be re-identified (e.g., mosaic effect)
• Quasi-identifiers can lead to re-identification if not protected
  
• Choosing privacy parameters involves balancing risk and data utility
• Responsible data handling requires both technical skill and ethical awareness

Attribution

• DSCI 200 - Navigating Data: Acquisition, Exploration and Management, UBC ⭐️
• Data Privacy Handbook
• DSCI 541: Privacy, Ethics, and Security at UBC
• Harvard University Privacy Tools Project: Differential Privacy
• STA 199: Introduction to Data Science and Statistical Thinking, Duke University