# A New Approach to Privacy-Preserving Multiple Independent Data Publishing
## 1 Introduction  
Data sharing helps the individual researcher and research organizations to run data analytics operations on published databases. However, the publishing of data may jeopardize personal privacy and disclose the sensitive values [1]. In recent decades, the sharing of personal data has resulted in numerous incidents involving data privacy breaches [2; 3], with disastrous results for the reputations and finances of organizations. Privacy-preserving data publishing methods are anonymizing the published data to preserve user privacy while allowing organizations to release their datasets [4]. Personal privacy is ensured by privacy-preserving data publishing methods and anonymization of the data at the time of widespread publication. Although identifying attributes like social security numbers and names are never published for data mining purposes, sensitive data may still flow due to linking attacks, whereby an attacker may reveal hidden identities or sensitive data by linking the published data attributes with other publicly available data sources [5]. The attributes that can be efficiently used to create such links, such as sex, zip code, and age, are called quasi-identifiers (_QIs_). Anonymization requires the alteration of these attributes to prevent such attacks while preserving the maximum possible utility of the released data. _k-anonymity_[6] is the first privacy model for privacy-preserving data publishing which generalizes the attribute values of the quasi-identifiers so that each of the released records becomes indistinguishable from at least _k_-1 other records when predicted on those attributes. As a result, each person can be associated only with sets of records of size at least \(k\) in the anonymized table. While the goal of _k-anonymity_ is to prevent identity disclosure, the later privacy models _l-diversity_[7] and _t-closeness_[8] aim at preventing disclosure of sensitive attributes by requiring restrictions on the distribution of sensitive values in each subset of records that are indistinguishable by their _QIs_. Existing anonymization methods mainly concentrate on one-time data publication [6; 7; 9], in which a data publisher anonymizes a dataset without considering other published datasets. In many cases, multiple views of a dataset [10; 11] or a series of datasets in distinct time stamps [12; 13; 14; 15; 16] are published. An example of the former case is the publication of data with different generalization schemes for different purposes, and an example of the latter is a quarterly publication of hospital data. Both examples are multiple-time data publications. Our previously published research [17] concentrates on multiple-time data publishing for bike sharing datasets. When the information of an individual remains in multiple datasets, an adversary may examine the intersection of some anonymized datasets to reveal the individual's private information even though it is preserved in each separate publication [12; 18]. Let us look at an example of how multiple publications can lay information open to a composition attack, which uses the intersection of some published datasets to deduce the sensitive values of individuals whose records are in multiple datasets. Tables 1 and 2 contain data segments from two hospitals, both including the same person's health records. Assume that [PERSON]'s personal information (Age = 22, Sex = Male, Zipcode = 47905), is known to the adversary. The adversary also knows that [PERSON] visited two hospitals for medication. We can assume that the two hospitals published their data without consulting each other. Tables 3 and 4 are the anonymized tables published by the two hospitals. We will see that this would result in an increased probability of breaching [PERSON]'s privacy from their published data. It is true that the adversary cannot find a person's sensitive information in either dataset since both satisfy _k-anonymity_ or _l-diversity_.