Anonymizing data can help you to leverage sensitive or personal data without compromising privacy
SAP HANA is the first business data platform to provide built-in, real-time data anonymization.
In this video, we give you a brief introduction to the data anonymization capabilities available
with HANA 2 SPS 03.
First, let's have a look at why data needs to be anonymized in the first place.
Let's say during the sales process, you collect personal data from your customers, for example,
to determine their credit rating.
Typical data collected includes education, income, relationship status, and so on.
Such data is obviously personal and sensitive, but it is purpose bound – it allows you
to deliver a product or a service.
If you want to use the data for a different purpose, say letting your data scientists
extract information about your customer base to improve marketing strategies, you either
have to get consent from your customers, or anonymize the data.
Trivial modifications to the data like replacing information that directly identifies an individual
such as name or social security number, or simply removing the information is not enough.
Re-identification is still possible, for example, if additional information is obtained.
A more structured approach to modifying data for privacy protection is provided by anonymization methods.
SAP HANA supports two methods: k-anonymity and differential privacy.
k-anonymity is an intuitive and widely used method for modifying data for privacy protection.
It works not by eliminating the information that could re-identify an individual, but
by generalizing it.
The idea is to group attributes in such a way that valid statistical insights into the
data are possible, but finding out something private about an individual is difficult.
You could think of it as hiding individuals in a crowd.
Imagine a data set containing patient information.
The correlation between patient weight and illness is interesting for research purposes.
Some things in the data set like name and date of birth are unique identifiers and of
course must always be removed.
Things like location and weight, on the other hand, may not identify someone directly but
could if combined.
These are called quasi-identifiers.
So, if I know Martin is in this data set and I know he comes from Hamburg and is overweight,
I could identify his condition, even though his name has been removed.
With k-anonymity, you define hierarchical groups to make such quasi-identifying information
less specific and in this way, reduce the scope for re-identification.
For example, we could generalize the cities into countries, and weights into ranges.
But how many individuals must be in a crowd for it to be considered anonymous?
That's where the k value comes in.
k specifies the minimum number of records that must have the same combination of quasi-identifying
information.
In this example k=2, so every location and weight group must have at least two members
each.
So now even though we know that Martin is overweight and is probably one of the members
of the 100 – 150 kg group, we can't identify his specific illness, but a researcher could
still work with the data.
In a real-life use case of course, the groups would be larger.
Now, what about differential privacy?
Unlike k-anonymity, differential privacy provides formal statistical privacy guarantees.
And while k-anonymity works best with categorical data, like medical records, differential privacy
is typically applied to numerical data in statistical databases.
Differential privacy works by adding noise to sensitive values to protect individual
privacy, while maximizing the accuracy of queries on the data set as a whole.
Let’s have a look at a different example to illustrate this.
Imagine a data set containing employee salary information.
Identifiers such as name and date of birth have been removed.
Such information could be used to analyze average salaries, or to learn more about the
general geographical distribution of salaries.
If you use differential privacy to apply noise to the salary column, the values will be changed
in such a way that individually they don't make any sense, but the outcome of statistical
queries on the whole data set remains approximately the same.
This is because the noise values are generated in such a way that they almost cancel each
other out if large amounts of data are analyzed.
As a general rule, the more data you have in your data set, the more precise analysis
on the anonymized data will be.
You'll find more detailed technical information on how differential privacy works and how
to configure it in the documentation.
With HANA 2 SPS 03, you can anonymize the output of calculation views using both k-anonymity
and differential privacy.
The graphical calculation view editor of the SAP Web IDE for SAP HANA provides an anonymization
view node, in which you can select the required anonymization method and define the level
of privacy.
And an anonymization report is available in SAP HANA cockpit to facilitate communication
between data scientists and data protection officers.
You can find out more about data anonymization on sap.com/data-anonymization and in the SAP
HANA documentation.
Also, check out the video tutorial on anonymization from the SAP HANA academy.