Visualizing re-identification risk using Data Studio

This topic shows how to measure k-anonymity of a dataset using Sensitive Data Protection and visualize it in Data Studio. By doing so, you'll also be able to better understand risk and help evaluate the trade-offs in utility you might be making if you redact or de-identify data.

Though the focus of this topic is on visualizing the k-anonymity re-identification risk analysis metric, you can also visualize the l-diversity metric using the same methods.

This topic assumes you're already familiar with the concept of k-anonymity and its utility for assessing the re-identifiability of records within a dataset. It will also be helpful to be at least somewhat familiar with how to compute k-anonymity using Sensitive Data Protection, and with using Data Studio.

Introduction

De-identification techniques can be helpful in protecting your subjects' privacy while you process or use data. But how do you know if a dataset has been sufficiently de-identified? And how will you know whether your de-identification has resulted in too much data loss for your use case? That is, how can you compare re-identification risk with the utility of the data to help make data-driven decisions?

Calculating the k-anonymity value of a dataset helps answer these questions by assessing the re-identifiability of the dataset's records. Sensitive Data Protection contains built-in functionality to calculate a k-anonymity value on a dataset based on quasi-identifiers that you specify. This helps enable you to quickly evaluate whether de-identifying a certain column or combination of columns will result in a dataset that is more or less likely to be re-identified.

Example dataset

Following are the first few rows of a large example dataset.

For the purposes of this tutorial, user_id will not be addressed, as the focus is on quasi-identifiers. In a real-world scenario, you would want to ensure that user_id is redacted or tokenized appropriately. The score column is proprietary to this dataset, and it's unlikely an attacker would be able to learn it by other means, so you will not include it in the analysis. Your focus will be on the remaining age and title columns, with which an attacker could potentially learn about an individual through other sources of data. The questions you're trying to answer for the dataset are:

• What effect will the two quasi-identifiers—age and title—have on the overall re-identification risk of the de-identified data?
• How will applying a de-identification transformation affect this risk?

You want to be sure that the combination of age and title won't map to a small number of users. For example, suppose there is only one user in the dataset whose title is Programmer I and who is age 69. An attacker might be able to cross-reference that information with demographics or other available information, figure out who the person is, and learn the value of their score. For more information about this phenomenon, see the "Entity IDs and computing k-anonymity" section in the Risk analysis conceptual topic.

Step 1: Calculate k-anonymity on the dataset

First, use Sensitive Data Protection to calculate k-anonymity on the dataset by sending the following JSON to the DlpJob resource. Within this JSON, you set the entity ID to the user_id column, and identify the two quasi-identifiers as both the age and title columns. You're also instructing Sensitive Data Protection to save the results to a new BigQuery table.

JSON input:

POST https://dlp.googleapis.com/v2/projects/dlp-demo-2/dlpJobs

{
  "riskJob": {
    "sourceTable": {
      "projectId": "dlp-demo-2",
      "datasetId": "dlp_testing",
      "tableId": "dlp_test_data_kanon"
    },
    "privacyMetric": {
      "kAnonymityConfig": {
        "entityId": {
          "field": {
            "name": "id"
          }
        },
        "quasiIds": [
          {
            "name": "age"
          },
          {
            "name": "job_title"
          }
        ]
      }
    },
    "actions": [
      {
        "saveFindings": {
          "outputConfig": {
            "table": {
              "projectId": "dlp-demo-2",
              "datasetId": "dlp_testing",
              "tableId": "test_results"
            }
          }
        }
      }
    ]
  }
}

Once the k-anonymity job has completed, Sensitive Data Protection sends the job results to a BigQuery table named dlp-demo-2.dlp_testing.test_results.

Step 2: Connect results to Data Studio

Next, you'll connect the BigQuery table you produced in Step 1 to a new report in Data Studio.

1. Open Data Studio.

   Open Data Studio

2. Click Create > Report.

3. In the Add data to report pane under Connect to data, click BigQuery. You may need to authorize Data Studio to access your BigQuery tables.

4. In the column picker, select My projects. Then choose the project, dataset, and table. When you're done, click Add. If you see a notice that you're about to add data to this report, click Add to report.

The k-anonymity scan results have now been added to the new Data Studio report. In the next step, you'll create the chart.

Step 3: Create the chart

Do the following to insert and configure the chart:

1. In Data Studio, if a table of values appears, select it and press Delete to remove it.
2. On the Insert menu, click Combo chart.