# How can I measure data anonymity when present summary statistics

I am looking to present users with aggregate statistics of a highly sensitive underlying dataset. See example data below:

Underlying Data (n=4)
+----------------+------------------------+------------+-------------+--------------+
|      Name      | Blood Pressure (mm Hg) | Height(cm) | Weight (kg) | Gender (m/f) |
+----------------+------------------------+------------+-------------+--------------+
| Bobby Boberson |                    121 |        183 |          72 | m            |
| Robby Roberson |                    109 |        171 |          69 | m            |
| Timmy Tomerson |                    119 |        201 |         101 | m            |
| Suzzy Suzerson |                    101 |        102 |          49 | f            |
+----------------+------------------------+------------+-------------+--------------+



Let's say that we want to present a single user the average height of all other users. Is there a good way to quantify the risk involved in reverse calculating said metric?

If we call the number of rows in the data above n. In the case of n=2 it would be easy for a bad actor to calculate metrics of another user (assuming they know n=2), see example below in which Robby Roberson is a bad actor.

Underlying Data (n=2)
+----------------+------------------------+------------+-------------+--------------+
|      Name      | Blood Pressure (mm Hg) | Height(cm) | Weight (kg) | Gender (m/f) |
+----------------+------------------------+------------+-------------+--------------+
| Bobby Boberson |                    121 |        183 |          72 | m            |
| Robby Roberson |                    109 |        171 |          69 | m            |
+----------------+------------------------+------------+-------------+--------------+

Aggregate View (Robbys View)
+-----------+------------------------+------------+-------------+--------------+
|   Name    | Blood Pressure (mm Hg) | Height(cm) | Weight (kg) | Gender (m/f) |
+-----------+------------------------+------------+-------------+--------------+
| Mean(n=2) |                    115 |        177 |       70.5  | m            |
+-----------+------------------------+------------+-------------+--------------+

Given Robbys data and knowledge of the mean he can calculate Bobbys values


If we increase the value for n then the risk of a bad actor estimating values for other users decreases. Is there a way to quantify said risk? I am looking to be able to quantify the risk and set a threshold in order to preserve users data anonymity.

• Calculating the mean over only a few people would be risky anyway, because people will wrongly assume that it's representative of the general population. Imho one needs at least 20 individuals to start considering the mean as a representative statistic. For a group of 20 people it would take 19 people to know each other and agree to share their own value in order to determine exactly the remaining 20th person's value from the mean, so I'd say it's pretty unlikely. – Erwan Oct 16 '19 at 18:40