id: "SI-19(06)" title: "Differential Privacy" family: "SI" family_name: "System and Information Integrity" sort_id: "si-19.06" priority: "P1" implementation_level: "system" parent: "SI-19" enhancement: True
Statement
Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.
Guidance
The mathematical definition for differential privacy holds that the result of a dataset analysis should be approximately the same before and after the addition or removal of a single data record (which is assumed to be the data from a single individual). In its most basic form, differential privacy applies only to online query systems. However, it can also be used to produce machine-learning statistical classifiers and synthetic data. Differential privacy comes at the cost of decreased accuracy of results, forcing organizations to quantify the trade-off between privacy protection and the overall accuracy, usefulness, and utility of the de-identified dataset. Non-deterministic noise can include adding small, random values to the results of mathematical operations in dataset analysis.
Assessment Objective
the disclosure of personally identifiable information is prevented by adding non-deterministic noise to the results of mathematical operations before the results are reported.
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
de-identification procedures
system configuration
de-identified datasets
differential privacy tools
system security plan
privacy plan
privacy impact assessment
privacy risk assessment documentation
other relevant documents or records
Organizational personnel responsible for de-identifying the dataset
organizational personnel with information security and privacy responsibilities
Online query systems
automated mechanisms supporting and/or implementing differential privacy