# Collecting, Processing and Secondary Using Personal and (Pseudo)Anonymized Data in Smart Cities
## 3 Background Concepts
### Privacy Models  
Privacy models are rules and algorithms applied to data, resulting in transformations and operations that can be measured and quantified [48]. The literature shows that some authors also refer to the privacy model as a metric to ensure the re-identification risk threshold has not been surpassed.  
The literature includes a variety of competing and complementary privacy models. Besides its well reported weakness [49], \(k\)-anonymity [50, 51] is the most popular [52] privacy model and is still widely accepted as the golden standard [53] for dataset generalization. A dataset is \(k\)-anonymous if, and only if, for any combination of the associated quasi-identifier attributes, there are at least another (\(k-1\)) individuals who share the same values for those same attributes values. In the literature, a large body of work [54, 55, 56, 57, 58, 59, 60, 61] contributes with variations of \(k\)-anonymity. A first weakness relies on the assumption that the set of attributes that an intruder can use to re-identify an individual (the set of quasi-identifiers) is known. This assumption is hazardous when considering the continuous release of new public datasets. Although \(k\)-anonymity protects against identity disclosure by hiding the individual into a group or equivalence class, it is not enough to provide privacy if sensitive values in an equivalence class lack diversity or if the attacker has background knowledge. The family of \(l\)-diversity privacy models [62, 63] addresses the lack of diversity of sensitive values by ensuring that all equivalence classes contain at least \(l\)-diverse or \"well-represented\" values for the sensitive attribute. The \(l\)-diversity addresses the homo  
Figure 1: Data privacy spectrum.  
geneity and background knowledge attacks. The \(l\)-diversity is difficult to archive, does not consider the distribution of sensitive attributes and is not even necessary for many datasets. Because of these limitations, [64] presented the \(t\)-closeness privacy model. The \(t\)-closeness model achieves privacy by keeping the distribution of each quasi-identifier's sensitive attribute \"close\" to their distribution in the dataset. This prevents an attacker from learning information about an individual's sensitive attribute value that is not available from the dataset.  
Differential privacy [65] is a well-known and mathematical definition-based privacy protection model that ensures that data is collected and analyzed in a way that preserves the privacy of individuals while still allowing for meaningful insights to be drawn from the data. The basic idea behind differential privacy is to add noise to the data so that it is statistically difficult to determine whether or not a particular individual's data was used in the analysis. By definition, the output is not highly affected by the addition or the removal of a single record of the dataset. Differential privacy has been widely adopted in various fields, including healthcare, finance, transportation and smart cities. Among its limitations, it can be computationally expensive to implement and it can be challenging to determine the appropriate noise level for a given dataset.