# Feedback-Based Integration of the Whole Process of Data Anonymization in a Graphical Interface
## 1 Introduction
### Specific Features of sdcApp  
We want to outline that the whole process of anonymization is integrated in a natural manner in sdcApp. The general aim of sdcMicro's user interface sdcApp is to map and integrate the entire process of anonymizing a dataset. This process starts by incorporating the original, possibly unsafe microdata into the system. Note that sdcApp supports importing and exporting data in several formats (STATA, SAS, SPSS, and R), suitable to use for user of other software. In addition, any dataset loaded into the workspace of R can be easily accessed and imported in the app.  
Once data are available, it is possible to inspect and modify them. Afterwards, the interactive anonymization process starts. In this stage, it is mandatory to select a risk scenario. Given this scenario, data utility, and risk measures are updated on the fly as soon as a disclosure control technique has been applied and/or the data are modified. The user can easily revert the last step if the analysis of risk or data utility indicators shows that the choice of parameters for the selected method is not optimal. This motivates to try out different parameter values and/or methods. At any given time, comparisons of variables between the (unsecure) raw dataset and the current state of the dataset can be analyzed graphically using a set of suitable statistics. The sdcApp itself has access to a large collection of algorithms discussed and developed in academic literature (including methods for global re-coding, local suppression, postrandomization, noise addition, microaggregation, and many more); and they are all optimized for large datasets.  
Another important design issue was to provide full reproducibility. To achieve this, all anonymization steps applied within the GUI are internally stored. The R-code, which is needed to recreate the current state, is internally tracked and can be viewed in the App and also downloaded to a file.  
The GUI also helps users and agencies by preparing reports on the process suitable for internal and external audiences. Such reports can be created and downloaded from within the interface.  
We note that all data including the original, possible unsafe raw data are kept on the local computer and are never uploaded anywhere. Thus, it is not a security issue at all when the anonymization  
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**Method/Software** & \(H\)-Argus **4.2** & Arx & sdcApp\(>\)**1.1.0** \\ \hline frequency counts & & & \\ individual risk (IR) & & & \\ IR on households & & & \\ \(l\)-diversity & & & \\ \(t\)-closeness, \(\delta\)-presence & & & \\ suda2 & & & \\ global risk (GR) & & & \\ \hline re-coding & & & \\ local suppression & & & \\ swapping & & & \\ param & & & \\ adding correlated noise & & & \\ microaggregation & & & \\ \hline utility measures & \(\circ\) & \(\circ\) & \\ \hline Import/Export & \(\circ\) & \(\circ\) & \\ Interactivity & & \(\circ\) & \\ Reproducibility & & & \\ \hline reporting & & & \\ \hline platform independent & & & \\ free and open-source & & & \\ \hline \hline \end{tabular}
\end{table}
Table 1: List of methods that can be accessed via a GUI. Circles indicate only limited potentiality/support.  
process is done in a web-based app. However, this approach allows to give users easily accessible additional information. For example, throughout the GUI question mark icons are displayed. Hovering with the mouse over these small icons triggers a pop up window providing help texts and useful information. As well-known, intuitive inputs such as drop-down menus, sliders, checkboxes or buttons are used within the GUI that typically do not need specific explanations to users.  
The availability of a GUI for applying common anonymization methods has the potential to lower barriers to a greater number of users, but also experienced users of sdcMicro may benefit from using the GUI because of its support of re-coding and on-the-fly reporting of utility and risk after every intervention.