Private Surveys for the Public Good

Protecting the privacy of individuals’ data collected while taking a survey has always been a challenging task. To date, survey data holders remove what is referred to as Personally Identifiable Information (PII). Despite these efforts, it has been repeatedly shown possible to uniquely reidentify people in the dataset and recover all of their data. The goal of our project is to create the first ever consumerfacing application that uses a controlled amount of randomness to induce anonymity in online surveys. This means that any individual may vote on a particular poll and his/her identity and associated responses will be probabilistically protected. To accomplish this, we built on the theoretical results associated with Differential Privacy. Differential Privacy is a statistical technique that allows data holders to guarantee the privacy of those in the dataset. It works by adding a calculated amount of random noise to the results of every query on the dataset. When the result of a query on the dataset depends significantly on a very small subset of individuals in the dataset, then the amount of noise added masks their responses keeping the survey results anonymous. When the result of a query on the dataset does not depend on a small subset of responses, then the added noise becomes negligible allowing us to learn about the population as a whole. We created a free online application, where survey respondents should feel comfortable answering truthfully, which in turn allows survey creators to ask personal and/or sensitive questions to gather important insights. I. PROBLEM STATEMENT One of the most prominent problems of today is the need for guaranteed privacy. Some questions that may come to the internet user’s mind include ’Is my data really private? ’; ’Can my information be traced back to me? ’; ’What is this data being used for? ’. These are all questions that come to mind when asked to provide sensitive data. One main application of this concern is when individuals participate in an ’anonymous’ survey. When individuals participate in this ’anonymous’ survey, one assumes that the data is private and can not be traced back to them. However, privacy is NOT guaranteed in these situations. By using machine learning techniques, de-anonymization of the data can occur by crossreferencing data sets. This issue leads to concern for many corporations who are trying to protect their users’ privacy in which this privacy issue can affect their reputation if these concerns are not taken care of. At the same time, users are more inclined to not provide their data to corporations, which in turn affects the way corporations can build new products, form new policies, and improve upon current ideas without this feedback data. Thus, our focus is on the application of privacy of data in survey applications. And the research question we have had in mind pertaining to this application is ’How can we better protect people’s privacy for the benefit of the public good? ’ How we came upon this concern of consumer data privacy is in regards to the Netflix Prize. In 2007, Netflix was providing $1,000,000 million to whoever could improve their movie recommendation algorithm. More specifically, the Netflix Prize sought to substantially improve the accuracy of predictions about how much someone is going to enjoy a movie based on their movie preferences. As part of this contest, Netflix publicly released a large dataset containing Netflix subscribers’ movie ratings. These movie ratings were considered ’anonymous’ by Netflix, as they removed the consumer’s name and replaced it with an anonymous identifier. However, two computer scientists demonstrated that removing the names of the consumers or personally identifiable information in general, doesn’t do enough for privacy. They showed that by cross-referencing movie ratings from IMDb with Netflix’s ’anonymous’ movie ratings is enough to identify people. [1] ”If you know their name and a few records, then you can identify that person in the other (private) database. ” [2] Thus, de-anonymization techniques expose the danger of public reviews published by IMDb which can identify a couple of users within the Netflix private database. More generally, the research demonstrated that information that a person believes to be ’private’ and ’anonymous’ could be used to identify them in other private databases. These consumers can be identified in terms of their beliefs, their interests, and other sensitive data. Thus, this is a major concern for users that use survey applications and provide data that is necessary for certain corporations. Existing technology and current solutions in survey applications today involve survey creators enforcing their own privacy policies. Usually, survey creators or companies who provide surveys remove personally identifiable information (zip code, email, birthday, etc.). However, these current solutions still leave users vulnerable to de-anonymization, using only a small amount of external information, as noted with the Netflix prize example. Differential privacy, however, can help solve this issue and protect users sensitive information. Differential privacy is essentially a promise from the data holder to the survey participant that their information will be protected. Mathematically, it protects the privacy of users by injecting a controlled amount of randomness into the results. Our goal is to design a consumer application using the concept of differential privacy to ensure that survey creators can obtain accurate insights while simultaneously ensuring that survey participants feel their responses are actually being protected. Current applications of differential privacy are designed to work for complex queries, are designed for working with extremely large data sets, are designed for working with complete pre-existing data sets, and arent designed to share results. Our application makes differential privacy more accessible through an easy-to-use website. The website collects and analyzes results in a differentially private way, while keeping track of the amount of privacy. Our contribution is a free and easy-to-use survey application that allows survey creators to obtain accurate insights while simultaneously ensuring that ensuring that survey respondents feel their responses are being kept private. We want individual answers to have no impact on released results and for published results to not give any new information on any individual user. This application allows for easy collection and analysis of the survey results while also maintaining differential privacy.