Differentially Private Release of Israel's National Registry of Live Births

Concepts de base

The authors present a differentially private scheme to release synthetic microdata from Israel's National Registry of Live Births, balancing privacy protection and data utility through a co-design process with stakeholders.

Résumé

The authors were tasked with efficiently processing and analyzing content from Israel's National Registry of Live Births to release insights, while protecting the privacy of mothers and newborns. They followed a co-design process with stakeholders to develop a differentially private scheme for releasing synthetic microdata from the registry.

Key highlights:

1. The authors used differential privacy as the formal measure of privacy loss, with an end-to-end privacy loss budget of ε = 9.98.
2. They employed the private selection algorithm of Liu and Talwar to bundle together multiple steps such as data transformation, model generation, hyperparameter selection, and evaluation, while preserving differential privacy.
3. The model generation algorithm selected was PrivBayes, and the evaluation was based on a list of acceptance criteria covering statistical queries like contingency tables, conditional means, and linear regressions.
4. To address stakeholder concerns, the authors incorporated notions of faithfulness (record-level similarity between original and synthetic data) and face privacy (no unique records in the synthetic data).
5. Experiments on public data were used to narrow down the configuration space and improve the quality of the final released dataset, which met all acceptance criteria.
6. The released dataset, along with detailed documentation, was made publicly available in February 2024.

Stats

The total number of live births in the dataset is 165,915.
The maximal error in contingency tables and histograms is 0.440% out of the total number of records.
The maximal relative error in 1-way marginals is 1.284 times the true value.
The error in conditional mean of parity is -0.014 live births.
The error in conditional mean of birth weight is 28.634 grams.

Citations

"The release was co-designed by the authors together with stakeholders from both inside and outside the Ministry of Health."
"We used differential privacy as our formal measure of the privacy loss incurred by the released dataset."
"We extensively used the private selection algorithm of Liu and Talwar (STOC 2019) to bundle together multiple steps such as data transformation, model generation algorithm, hyperparameter selection, and evaluation."

Idées clés tirées de

Differentially Private Release of Israel's National Registry of Live Births

by Shlomi Hod,R... à arxiv.org 05-02-2024

https://arxiv.org/pdf/2405.00267.pdf

Questions plus approfondies

How can the differentially private scheme be extended to release data from multiple years of the Live Birth Registry, while maintaining high data utility and privacy guarantees?

To extend the differentially private scheme to release data from multiple years of the Live Birth Registry, several considerations need to be taken into account to ensure high data utility and privacy guarantees:

Data Aggregation: Instead of treating each year as a separate dataset, the data from multiple years can be aggregated into a single dataset. This approach allows for a more comprehensive analysis while maintaining differential privacy guarantees.

Incremental Release: Data from each year can be released incrementally, with each release being differentially private. This approach ensures that the privacy loss budget is distributed across multiple releases, reducing the risk of privacy breaches.

Consistent Configuration: Maintaining a consistent configuration across multiple releases is crucial for ensuring data utility and comparability. This includes consistent data transformations, model selection algorithms, and hyperparameters.

Privacy Loss Budget Allocation: Allocating the privacy loss budget appropriately for each year's release is essential. The budget should be distributed based on the sensitivity of the data and the desired level of privacy protection.

Evaluation Criteria: Developing a set of acceptance criteria that can be applied consistently across multiple years is important. These criteria should reflect the specific needs of data users and ensure that the released data meets quality standards.

By following these strategies, the differentially private scheme can be effectively extended to release data from multiple years of the Live Birth Registry, maintaining high data utility and privacy guarantees.

What are the potential limitations of the faithfulness and face privacy requirements, and how might they impact the overall data quality and utility?

Faithfulness Limitations:

Complexity: Ensuring record-level faithfulness can be computationally intensive, especially for large datasets. This may impact the scalability of the scheme and the efficiency of data generation.

Subjectivity: The definition of faithfulness relies on the cost function, which may be subjective and vary based on stakeholder preferences. This subjectivity can introduce bias and affect the interpretation of the results.

Trade-off with Privacy: Striving for high faithfulness may compromise differential privacy guarantees, as stricter matching requirements could lead to increased privacy risks.

Face Privacy Limitations:

Loss of Information: Enforcing face privacy by removing unique records may result in the loss of valuable information. Unique records could contain important insights that are crucial for certain analyses.

Data Distortion: Applying dataset projections to achieve face privacy may distort the data distribution, affecting the accuracy of statistical analyses. This distortion could impact the overall data quality and utility.

User Expectations: Stakeholders' expectations of face privacy may not align with the technical requirements of differential privacy. Balancing these expectations while maintaining privacy guarantees can be challenging.

Addressing these limitations requires careful consideration of the trade-offs between data utility, privacy protection, and stakeholder expectations.

What other types of analyses, beyond the acceptance criteria evaluated in this work, could be enabled by the differentially private synthetic data release, and how can the documentation help users understand the appropriate and inappropriate uses of the data?

Beyond the acceptance criteria evaluated in this work, the differentially private synthetic data release enables various types of analyses, including:

Correlation Analysis: Studying relationships between different variables in the dataset while preserving privacy.

Trend Analysis: Identifying patterns and trends over time without compromising individual privacy.

Cluster Analysis: Grouping similar records together based on certain characteristics while maintaining differential privacy.

Predictive Modeling: Building predictive models without exposing sensitive information about individuals.

The documentation plays a crucial role in helping users understand the appropriate and inappropriate uses of the data by:

Clearly Defining Use Cases: Providing examples of valid use cases for the data release, demonstrating how it can be utilized for research, policy-making, and analysis.

Privacy Guidelines: Outlining the privacy implications of the data release and guiding users on how to handle and analyze the data responsibly.

Data Limitations: Communicating the limitations of the data, including potential biases, inaccuracies, and constraints imposed by differential privacy.

Case Studies: Presenting real-world scenarios where the data can be effectively used, along with examples of misuse and its consequences.

By incorporating these elements into the documentation, users can make informed decisions about the appropriate ways to utilize the differentially private synthetic data while respecting privacy and maintaining data utility.