Lion Cipher Lab
Measure and reduce re-identification risk with k-anonymity
- GRC / Compliance
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Deleting the name column feels like anonymising a dataset, and it is one of the most expensive mistakes in privacy. Latanya Sweeney showed that just three ordinary fields - ZIP code, date of birth and sex - uniquely pick out the large majority of the US population (her original estimate was about 87%), which is how she famously re-identified a state governor's medical record from a 'de-identified' hospital release. Those fields are QUASI-IDENTIFIERS: harmless-looking on their own, uniquely identifying in combination. k-anonymity is the first concrete, measurable defence against them - it…
What you'll learn
- what a quasi-identifier is, and why removing names is not anonymisation
- the definition of k-anonymity: every record indistinguishable from at least k-1 others on the quasi-identifiers
- computing the k of a real dataset in Python (group by the quasi-identifiers, take the smallest group)
- reducing re-identification risk with generalisation (truncate ZIP, bucket birth year into decades)
- reducing risk with suppression (dropping the last uniquely-identifying outliers)
- reading a before / after k measurement to prove a privacy control actually worked
- the privacy-vs-utility tradeoff: generalisation destroys detail as it raises k
- why k-anonymity is not enough on its own, and what l-diversity, t-closeness and differential privacy add
Steps in this lab
- The idea in one breath - quasi-identifiers and k-anonymity
- Set up - build a tiny synthetic dataset yourself
- MEASURE - compute the k of the raw dataset (the 'before' number)
- REDUCE, part 1 - generalisation (make the quasi-identifiers coarser)
- REDUCE, part 2 - suppression, and the 'after' number
- Judgment - what k-anonymity does NOT protect, and when it is enough