# Protecting Sensitive Data in the Information Age: State of the Art and Future Prospects
## 3 State-of-the-Art Privacy Measures
In our example, e.g., the age can be concealed in each patient record. In formalized terms, this is the application of a _projection operator_\(\Pi\) known from relational algebra. It is defined as:  
\[\Pi_{a_{1},\ldots,a_{n}}(R)=\{t[a_{1},\ldots,a_{n}]:t\in R\} \tag{2}\]  
Let \(R\) again be a relation and \(a_{1},\ldots,a_{x}\) be the attributes in it. Then, let \(t[a_{1},\ldots,a_{n}]\) be the restriction of the tuple \(t\) to the first \(n\) attributes. Third, data can be condensed prior to processing [114]. In our example, e.g., not every medical record is shared, but only aggregations of selected values. For instance, the records can first be grouped by diseases, and then, the average age of the patients for each disease can be shared. In formalized terms, this is the application of an _aggregate operator_\(\mathcal{G}\) known from relational algebra. It is written as follows:  
\[G_{1},G_{2},\ldots,G_{m}\mathcal{G}_{f_{1}(A_{1}),f_{2}(A_{2}),\ldots,f_{n}(A _{n})}(R) \tag{3}\]  
Let \(R\) again be a relation. Then, let \(G_{1},G_{2},\ldots,G_{m}\) be the attributes in \(R\) to group by, while each \(f_{i}\) is an aggregate function applied to the attribute \(A_{i}\) of the relation schema, e.g., sum, count, average, maximum, or minimum. Figure 8 graphically illustrates the functional principle of these three operators. The undeniable advantage of these three generic filtering techniques is that they can be applied to any type of data to preserve privacy. However, they are highly restrictive. Since entire data items or attributes are excluded from the processing, the amount of data--and thus the effective data quality--is greatly impaired. Yet, today's data refinement methods for deriving knowledge require large amounts of data to be effective. Therefore, perturbing the data typically leads to better results without compromising privacy. The goal is to tamper with specific aspects of the data only while ensuring that the data as a whole remain useful for data consumers [115]. However, there is no one-size-fits-all approach in this regard. Rather, specialized methods are needed that are tailored to the respective type of processing as well as the type of data involved. Only then can sensitive aspects of the data be concealed in a fine-grained manner without limiting the overall data quality [116]. In the following, we therefore discuss four filtering techniques in Sections 3.1-3.4 that are tailored to specific types of data: namely, location data, time series data, audio data, and image data. Section 3.5 then deals with a privacy approach that reorders the data in order to conceal certain patterns. In Section 3.6, statistical methods for privacy protection are addressed. Finally, Section 3.7 outlines how distributed processing can contribute to privacy. Due to the large number of research activities in the field of privacy, only a few representatives can be covered in each category. These seven privacy strategies are mapped to the application scenarios introduced in the corresponding subsections of Section 2. For each privacy strategies, we give a summary of its key strengths and weaknesses at the end of each subsection. To recap our review of the related work, Section 3.8 highlights the key findings. Figure 8: Graphical Illustration of the Effect of a Selection, Projection, and Aggregation on a Dataset.