Open Diffix is an MPI-SWS-supported open software project to develop strong but usable data anonymization. Open Diffix is built on the data anonymization technology Diffix, which has been developed in a research partnership between the group of Paul Francis and Aircloak GmbH. Open Diffix recently released its first tool, "Diffix for Desktop". Designed with extreme ease-of-use in mind, Diffix for Desktop can be used by non-experts to safely release sensitive data to the public. Diffix for Desktop frees users from concerns about anonymity, allowing them to focus on data quality.

We have launched the Open GDA Score Project at www.gda-score.org.  This is an open project to develop a set of tools and databases to generate anonymity scores for any data anonymization technique. The GDA Score, which stands for General Data Anonymity Score, is the first data anonymization measurement methodology that works with any anonymization technique. The GDA Score is a generalization of the measurement technique developed by Francis' group for the Diffix bounty program run last year. This was the first bounty program for anonymity. The GDA Score is of particular interest in Europe, where member states are expected to produce certification programs for anonymity.

The French Data Protection Authority CNIL has recognized the benefits of Diffix anonymization by republishing an article by Paul Francis in which the utility of Diffix anonymization is highlighted. Diffix is the anonymization technology developed in joint research between Francis' group and Aircloak GmbH.

Last year, CNIL published an article titled "Can anonymized data still be useful." The purpose of the article was to demonstrate that strong anonymization does not necessarily prevent useful analytics. In this work, CNIL uses K-anonymity on the New York City taxi database. Inspired by this effort, Francis shows that Diffix can be used for a wide range of analysis on the NYC taxi database, including trip times to LaGuardia airport, taxi driver work profiles, and congestion in the Manhattan financial district.

CNIL re-published the article under the title "Anonymity vs. Utility: Another shot at Anonymizing the New York City taxi dataset".

Bug bounty programs are a popular way to find security flaws in deployed systems. We are the first to use a bounty program to find flaws in anonymization schemes, namely the anonymization scheme we designed called Diffix. We take an empirical approach to anonymization rather than the more common formal approach. The empirical approach leads to anonymization schemes with high utility, but also uncertainties about the anonymization properties. The bounty program helps build understanding and confidence in Diffix. To learn more, visit challenge.aircloak.com

The session, entitled “Challenges and Strategies for Certifying Data Anonymization for Data Sharing,” brings together technical and legal experts to explore how Data Protection Officers (DPOs) can manage the complexities and uncertainties of GDPR-compliant data anonymization. The IAPP Congress will be held November 7-9 in Brussels.

Session Abstract:

Data sharing is increasingly important. Companies share data internally across business units to gain business insights, they share data externally with data analytics vendors, and they often share data simply to make money. Ensuring the anonymity of users in the data set is necessary. The process of approving or certifying anonymization however is costly, time consuming, and uncertain. Current approaches to anonymization are ad hoc at best. They require a custom strategy for each new data sharing scenario, and it is often unclear whether the data is really anonymized or not.

In this informative and lively session, corporate DPOs, vendors of analytics solutions, and privacy researchers share their experiences with data anonymization and the approval process. They provide case studies illustrating the pitfalls of "do it yourself" anonymization, and show how some new ready-for-use anonymization can eliminate the delays and guesswork of data anonymization.

Paul Francis will give the keynote address at the Oakland (IEEE S&P) Workshop on Privacy Engineering. The talk, entitled "The Diffix Framework: Revisiting Noise, Again", presents the first database anonymization system that exhibits low noise, unlimited queries, simple configuration, and rich query semantics while still giving strong anonymity.

The workshop will be held May 25 in San Jose, CA.

Talk Abstract:

For over 40 years, the holy grail of database anonymization is a system that allows a wide variety of statistical queries with minimal answer distortion, places no limits on the number of queries, is easy to configure, and gives strong protection of individual user data.  This keynote presents Diffix, a database anonymization system that promises to finally bring us within reach of that goal.  Diffix adds noise to query responses, but "fixes" the noise to the response so that repeated instances of the same response produce the same noise.  While this addresses the problem of averaging attacks, it opens the system to "difference attacks" which can reveal individual user data merely through the fact that two responses differ.  Diffix proactively examines queries and responses to defend against difference attacks.  This talk presents the design of Diffix, gives a demo of a commercial-quality implementation, and discusses shortcomings and next steps.

A jury chaired by renowned architect Prof. Gunther Henn evaluates fifteen drafts submitted as part of an architecture competition for the design of the institute's new buildings in Kaiserlautern and Saarbruecken. First prize is awarded to a design by the firm of Weinbrenner and Single in Nuertingen. The designs reflect a common architectural concept that fosters communication and cooperation, while each building has a distinct appearance that respects its situation within the campus of the Technical University of Kaiserslautern and Saarland University, respectively. Construction is expected to commence in 2007 and will cost about EUR 20M for both buildings.