NIST updates differential privacy guidelines to enable more data analytics

Guidelines for using differential privacy from the U.S. National Institute of Standards and Technology have been updated to make the privacy protection technology easier to apply.  This in turn will enable data analytics to be applied to more databases containing confidential information.

The technology itself is relatively mature, NIST says, but lacks standards that can make is easy to adopt and use.

Hence the update to NIST’s Guidelines for Evaluating Differential Privacy Guarantees (NIST Special Publication 800-226).

Differential privacy (DP) is a method of obscuring the identity of individuals in datasets while retaining the utility of the database as a source of statistical information, through the addition of random “noise.” The noise has the effect of de-identifying individuals in the dataset.

The technology is well-established as a privacy protection tool, and can be applied to biometrics.

A video shared by NIST gives the example of an emergency call in which a medical crisis is reported. If a cluster of similar medical crises are found through data analysis, a cause could be identified, and perhaps lives saved. But the call contains a bundle of personally identifiable information (PII), and even redacting the most obvious data points like the individual’s name and exact address may not be enough to prevent the re-identification of an individual. This is where the noise added by DP comes in.

NIST’s guidelines are intended to help organizations assess claims DP vendors make. They were originally released in draft form in December of 2023, and have been updated for ease of use.

NIST Scientist Gary Howarth, who co-authored the guidelines, says the update makes the language more precise and less ambiguous to help decision-makers “more clearly understand the trade-offs inherent in DP and can help understand what DP claims mean.”

The guidelines are not a complete primer on the subject, but include a reading list to help practitioners improve their understanding of how DP works.

“With DP there are many gray areas,” Howarth says. “There is no simple answer for how to balance privacy with usefulness. You must answer that every time you apply DP to data. This publication can help you navigate that space.”

Article Topics

data privacy  |  data protection  |  de-identification  |  differential privacy  |  NIST  |  standards