On Reverse Engineering Privacy Law

You may also like...

1 Response

  1. A.J. Sutter says:

    Thanks for this interesting post. There’s a passage in the Dwork paper that might help non-specialists like me understand the problem:

    A 1977 paper of Dalenius articulated a desideratum that foreshadows for databases the notion of semantic security defined five years later by Goldwasser and Micali for cryptosystems: access to a statistical database should not enable one to learn anything about an individual that could not be learned without access. We show this type of privacy cannot be achieved. The obstacle is in auxiliary information, that is, information available to the adversary other than from access to the statistical database, and the intuition behind the proof of impossibility is captured by the following example. Suppose one’s exact height were considered a highly sensitive piece of information, and that revealing the exact height of an individual were a privacy breach. Assume that the database yields the average heights of women of different nationalities. An adversary who has access to the statistical database and the auxiliary information “Terry Gross is two inches shorter than the average Lithuanian woman” learns Terry Gross’ height, while anyone learning only the auxiliary information, without access to the average heights, learns relatively little.

    … [This impossibility result] applies regardless of whether or not Terry Gross is in the database and … leads naturally to a new approach to formulating privacy goals: the risk to one’s privacy, or in general, any type of risk, such as the risk of being denied automobile insurance, should not substantially increase as a result of participating in a statistical database. This is captured by differential privacy. [Emphasis in original; cites and footnotes omitted]

    I think there are two, well, risks with this approach. One is in the word “risk”: how is it estimated? And the other is in the word “differential” (cf. “marginal” utility): by focusing on reducing the differential/marginal risk, we may ignore the problem in some cases that the underlying (i.e., total) risk is large.