# A New Approach to Privacy-Preserving Multiple Independent Data Publishing
## 1 Introduction
In the horizontal partition, the tuples are grouped in buckets or equivalence classes. In an equivalence class, the attribute values are randomly permuted to break the association between different columns. We introduce the cell generalization approach to increase the privacy of the published dataset. Hence each \(QI\) value will be linked with \(l\) distinct sensitive values, reducing the confidence that the adversary will have when breaching personal privacy. Tables 6 and 7 are the published tables from the two hospitals, generated using the anonymization technique proposed in this paper. The idea behind our approach is to increase the probability of false matches by linking the \(QI\) values with the \(l\) distinct sensitive values [25]. When a person's record is similar in two datasets, there will be common values in the intersection of the anonymized datasets, including \(QI\) values and sensitive values. When a person's record is not in the two datasets, there may still be a common record in both anonymized datasets, induced by two different patients having the same \(QI\) and sensitive values. Such a match is called a false match. We consider the example as mentioned earlier where user privacy is breached by the intersection of two published datasets. Tables 6 and 7 are published by the Merging method, and Table 8 is the intersection of Tables 6 and 7. From the intersection, the adversary cannot discover the actual \(QI\) values of the user. In fact, the first bucket or equivalence class of Table 8 contains 44 \(QI\) values. Now the adversary will need another publicly available data source to match his desired \(QI\) values, which we call a true match. The adversary will want to link this true match with the sensitive value. However, in the sensitive values column, i.e., Disease, there are three distinct values. It will thus be difficult for him to deduce an exact sensitive value for the particular \(QI\) values. \begin{table}
\begin{tabular}{c c c} \hline \hline (**Age, Sex**) & **Zipcode** & **Disease** \\ \hline (22, *) & 47905 & Ovarian Cancer \\ (22, *) & 47901 & Gastritis \\ (33–52, *) & 47905 & Flu \\ (33–52, *) & 47901 & Breast Cancer \\ \hline (54, M) & 47308 & Fever \\ (60, F) & 47902 & Dyspepsia \\ (60, F) & 47308 & Cancer \\ (64, F) & 47902 & Fever \\ \hline \hline \end{tabular}  
* denotes the generalization of the attribute value.  
\end{table} 
Table 6: Anonymized table of hospital A (Merging). \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Age** & **Sex** & **Zipcode** & **Disease** \\ \hline
22 & M & 47905 & Gastritis \\
33 & * & 4790 * & Breast Cancer \\  & & & Flu \\
60 & * & 47902 & Dyspepsia \\  & & 47902 & Fever \\ \hline \hline \end{tabular}  
* denotes the generalization of the attribute value.  
\end{table} 
Table 5: Intersection of Tables 3 and 4. The essential aim of our proposed Merging anonymization technique is to increase the probability of false matches during a composition attack. In a real-world scenario, since there will be more records, there will be a stronger probability of producing a false match for a \(Q\)I value. When we consider the ambiguity behind true and false matches, it is conceivable that the probability of a false match is higher than that of a true one. When a significant difference in such probabilities is achieved, the privacy of an individual is protected in multiple independent data publications. Putting this principle in the differential privacy context, the appearance of a common record in the published datasets is independent of whether or not the common record belongs to the same individual, and hence an adversary cannot be sure whether the sensitive value in the common record belongs to the person. The main contributions of the paper are summarized as follows. Equivalence classes are created, and attribute values are randomly permuted in the equivalence class to break the cross-column relation to increasing the published data privacy. A cell generalization approach is introduced to protect the published datasets from composition attacks.