Differential Privacy is often presented as the standard in terms of data protection.
At Octopize, we follow it very closely but we do not integrate it directly into our technology.
In fact, in practice, it presents major limitations — and that there are more robust and operational approaches to ensure confidentiality.
A mathematical guarantee, but incomplete
Differential confidentiality is based on an elegant mathematical definition: it aims to make the presence of an individual in a data set undetectable.
But this guarantee, as rigorous as it may be, does not cover all re-identification scenarios.
The EDPS (European Data Protection Board) recommends a systematic evaluation of the risk of re-identification in accordance with the 3 criteria it has identified to prevent any risk of incorrect configuration when using any anonymization method.
A method that is difficult to set up and understand
The key parameter for this method, called Epsilon (ϵ), measures the level of noise added to mask individuals.
Problem:
- It is very difficult to choose and to explain,
- and a bad value can make data less anonymous than expected, without the user noticing.
A powerful approach, yes, but with a high risk of poor implementation.
An unfavorable compromise: privacy vs. utility
In practice, add too much noise to ensure privacy destroys statistical quality data.
And in order to preserve quality, some actors artificially increase the parameter, thus weakening confidentiality.
This creates a precarious balance that is rarely satisfactory.
And a significant calculation cost
Each step of differential privacy consumes a lot of resources... Processing times are longer, energy consumption is increased, and the technological footprint is growing — often unnecessarily.
The Octopize alternative: post-verification
Instead of adding noise, we let's measure real privacy at the end of the generation process.
Our method:
- Quantifies the risk of re-identification on the final summary data in terms of the 3 EDPS criteria,
- Evaluate the impact reasonable of this risk depending on the context of use (AIPD)
- And stay verifiable, measurable, and transparent.
We can even test afterwards if our datasets respect the properties of a differentially private dataset — without suffering the disadvantages.
In summary
Differential privacy is an interesting tool, but it's not enough.
We prefer an approach more robust, measurable and compatible with the reality of uses.
