The verified neighbor approach to geoprivacy: An improved method for geographic masking

Abstract

Geographic information adds a powerful component to environmental epidemiology studies but can compromise subject confidentiality. Although locations are often masked by perturbing spatial coordinates, existing masks do not ensure that the perturbation area contains a sufficient number of valid surrogates to prevent disclosure, nor are they designed to minimize perturbation while maintaining a specified level of privacy. I introduce a new approach to geoprivacy in which real property parcel data with information about land use are used to develop a pool of verified neighbors. GIS (geographic information system) processing optionally restricts the pool to residences with values of environmental variables similar to those of the subject parcel. A surrogate is then randomly selected from the k members of the pool closest to the subject with k chosen to achieve the desired spatial privacy protection. The method guarantees the specified level of privacy even where population density is uneven while minimizing spatial distortion and changes to the values of environmental variables assigned to subjects. The method is illustrated with an example that found it to be more effective than random perturbation-based methods in both protecting privacy and preserving spatial fidelity to the original locations.

Addressing the data guardian and geospatial scientist collaborator dilemma: how to share health records for spatial analysis while maintaining patient confidentiality

“…Even though such aggregations can preserve spatial confidentiality, the information loss is high and often leads to issues such as the ecological fallacy. The verified neighbor mask [41] utilizes a pool of neighbors for relocating or displacing a spatial point, with all neighbors having an equal probability of becoming the destination location. The advantage of this method is its realistic placement of relocated points, though it is less useful for rural areas.…”

MaskMy.XYZ: An easy‐to‐use tool for protecting geoprivacy using geographic masks

“…A second generation of geographic masks is currently emerging that is characterized by the precise displacement of points using auxiliary data, particularly address data, and more accurate estimates of privacy. Two of the most recent masks that do this are location swapping and verified neighbor masks, which operate similarly (Richter, ; Zhang et al, ). The verified neighbor mask, for instance, works by first creating a pool of neighbors (i.e., addresses) around each point (e.g., the closest 20 addresses surrounding a given point), and then relocating each point to one of those neighbors at random.…”

“…The result of this technique is a minimum and guaranteed level of privacy, as well as the realistic relocation of points. Additionally, the verified neighbor mask was shown to protect privacy and reduce information loss when compared to random perturbation and donut geomasking (Richter, ). Location swapping, which again uses similar procedures, also leverages address data to perform better than its first‐generation counterparts (Zhang et al, ).…”

“…At roughly the same time as Spruill's measure was proposed, another measure, known as k ‐anonymity, was being developed within the computer science literature (Samarati & Sweeney, ), and has since become a central concept in geographic masking and the most popular method to measure privacy protection (Allshouse et al, ; Cassa et al, ; Hampton et al, ; Kounadi & Leitner, ; Richter, ; Zandbergen, ; Zhang et al, ). Formally, a dataset is k ‐anonymous when “every combination of values of quasi‐identifiers can be indistinctly matched to at least k individuals” (Samarati & Sweeney, , p. 4).…”

“…In this first application, Cassa et al () estimated spatial k ‐anonymity by multiplying population density by the displacement area. Spatial k ‐anonymity has since been measured using actual address data as well, resulting in the most accurate estimates of privacy protection currently available, although this comes at the cost of higher data requirements (Richter, ; Zhang et al, ).…”