Testdata/internal data

This screen allows the user to select data.frames that are available in the users-workspace when starting the user interface. Two test-data sets (testdata and testdata2, information on which is available from ?testdata) that are included in sdcMicro are always available. Pressing the action button below the drop-down selection input will make the GUI use the selected data frame.

R-dataset (.rdata)

Here users can opt to upload a file saved in R binary format. Users can change the options if character vectors should be automatically converted to factors and if variables that only contain missing-values only should be dropped. By clicking on the Browse button the user needs to select a rdata-file on disk which he wants to upload. For detailed explanation on the options, please see the chapter on additional options.

SPSS-file (.sav)

Here users can opt to upload a file exported from SPSS. Users can change the options if character vectors should be automatically converted to factors and if variables that contain only missing-values (‘NA’) only should be dropped. By clicking on the Browse button the user needs to select a sav-file on disk which he wants to upload. For detailed explanation on the options, please see the chapter on additional options.

SAS-file (.sasb7dat)

Here users can opt to upload a file exported from SAS. Users can change the options if character vectors should be automatically converted to factors and if variables that contain only missing-values (‘NA’) only should be dropped. By clicking on the Browse button the user needs to select a sas7bdat-file on disk which he wants to upload. For detailed explanation on the options, please see the chapter on additional options.

CSV-file (.csv, .txt)

Here users can opt to upload a text file where variables are separated by some characters. Typically these data would be exported from software such as Excel. It is crucial that users indicate if the data file has variable names in the first row and how variables are separated. At this point, users have the option to have character vectors automatically converted to factor or have variables that contain only missing-values (‘NA’) dropped when the data are read into the GUI. For columns read as character (text), the character " is ignored as quoting character and not imported. By clicking on the Browse button the user needs to select a txt or csv-file on disk which he wants to upload. For detailed explanation on the options, please see the chapter on additional options.

STATA-file (.dta)

Here users can opt to upload a file exported from Stata. Users can change the options if character vectors should be automatically converted to factors and if variables that contain only missing-values (‘NA’) only should be dropped. By clicking on the Browse button the user needs to select a dta-file on disk which he wants to upload. For detailed explanation on the options, please see the chapter on additional options.

Additional options

We now describe the choices users can make when uploading data.

Convert string variables (character vectors) to factor variables?

This option is not available when an existing data frame from the current workspace is selected/used. For any other selection, this radio button input has two possible choices, TRUE (the default value) and FALSE. If TRUE, any variables that are read into R as character-vectors should be automatically converted to a factor variable. Each distinct value of the variable will be a factor level in the imported dataset. If FALSE, no conversion is applied.

Drop variables with only missing values (NA)?

This option is not available when an existing data frame from the current workspace is selected/used. For any other selection, this radio button input has two possible choices, TRUE (the default value) and FALSE. If TRUE, any variables in which only NA-values are read in are removed from the data set. If this option is set to FALSE, these variables (if any) will not be dropped.

Does the first row contain the variable names?

This option is only available when a text/csv file is imported. This radio button input has two possible choices, TRUE (the default value) and FALSE. If TRUE, the first row of the imported data set will be interpreted as variable names, if FALSE, variable names are automatically generated.

Select the field separator (Comma, Semicolon, Tab)

This option is only available when a text/csv file is imported. The radio button input has three possible choices, Comma (the default value) Semicolon and Tab defining the value that is used to separate variables in the input file.

• Comma: the "," character is used as separator
• Semicolon: the ; character is used as separator
• Tab: tabulators (\t) are used as separators

Select File Input:

This option is not available when an existing data frame from the current workspace should be used. For any other selection, clicking on the Browse button allows the user to select a file on the local hard drive. A feature is that only files with the accepted file ending (e.g .dta when files from Stata .rdata when data exported from R should be imported) are shown. This reduces the risk, that a unsuitable file can be selected. Once a file has been selected, pushing the Open button immediately uploads the file so that the GUI can process it. If the file cannot be read into the system successfully, the user is presented with the resulting error message. If everything works out smoothly, microdata are now available and the left sidemenu changes. The user can now start the anonymization process. For further information, please have a look at the following sections.

Display microdata

This is the default selection, after microdata have been successfully imported or uploaded as described in uploading microdata. This page gives a short overview on the microdata. It shows the name of the imported file as well as the number of observations and the number of variables that are available. Below this information, the user is presented with an interactive table containing the current microdata. The variables can be sorted by clicking on the small arrows next to the variable names on top of the table. Also on the top, there is a dropdown field where users can select how many observations should be displayed on one page. On the bottom of the table users can find a dynamic pagination field which allows users to jump to a given “page” of the current table.

Explore variables

On this page users have the possibility to explore variables from the current microdata. Users have to choose a variable by selecting a variable from the dropdown field with label “Choose a variable”. The default value of this input field is the first variable in the dataset. Optionally, a second variable can be selected by choosing a variable from the dropdown field labelled “Choose a second variable (optional)” which has the default value of “None”. Once the variables have been selected, a graph and additional information is presented below. The specific output depends on the number of variable(s) chosen as well as their type:

One variable selected:

• the selected variable is of type factor or character:

In this case, a barplot of the factor levels is shown. Below that, a table showing for each factor level the level itself, how often it occurs and the corresponding percentage is shown. Below that, again the number and percentage of missing values is shown.

• the selected variable is of type integer or numeric:

In this case, a histogram of the selected variable is shown. Below the graph, a table showing main summary statistics (Minimum, Mean, Median, Maximum and 5%-, 25%-, 75%- and 95%-quantiles) are shown. Below this table, the number and percentage of missing values is displayed.

Two variables selected:

• Both variables are of type integer or numeric:

If both selected variables are continuous (numeric or integer), a scatterplot of the two variables is displayed. Below that, the correlation coefficient (Pearson) using only pairwise complete observations between the two variables is listed. Below that, two tables are shown. Each table shows the main summary statistics for one of the selected variables. The information included in the tables are (as in the case when only one continuous variable is selected) the Minimum, Mean, Median, Maximum and 5%-, 25%-, 75%- and 95%-quantiles of the variable. Finally, information on the number and percentage of missing values is shown for both variables.

• Both variables are of type factor or character:

In this case, a mosaicplot of the selected variables is shown as well as a table, containing a cross-tabulation of each levels (or unique values in case of a character input) that shows the number of percentages of each combination of codes given the two selected variables including any combinations with NA. Below this table, the number and percentage of missing values is displayed for both selected variables.

• One variables is of type factor or character, the other variable is of type integer or numeric:

In this case, a grouped boxplot of the continous variable (type is integer or numeric) is shown for each level or unique value of the non-continuous variable. Below, for each level of the non-continuous variable, the same summary statistics as already described above of the continuous variable are shown. Finally, the number and percentage of missing values is displayed for both selected variables.

Reset variables

When a microdata set is uploaded, a backup of the unmodified dataset is saved internally. This allows users to reset any modifications in variables in the inputdata file which can be done on this page. To do so, the user needs to select one or more variables from the select field which is by default empty. When all variables that should be reverted are selected, one has to click outside the dropdown field to close the input. Afterwards, an action button labelled Reset selected variable(s) to their original state occurs below the input field. Clicking on this button resets the selected variables to their original state. In case you want to remove already selected variables, you can just click on these variable names in the input field and either press the “backspace”- or “delete”” keys on the keyboard.

In any case, after pressing the action button, the GUI changes to the “Explore variables” page at which the first of the selected variable(s) is shown.

Use subset of microdata

On this page it is possible to decrease the size of the input data. This is especially useful if one wants to test different parameter settings and a run on the complete dataset would take long. To reduce the size of the input dataset, the user has to select a method using the drop down field Select a method to restrict the number of records and to select a value from the slider Set 'n' for the selected method. The following choices are possible on how to reduce the dataset, the range of values that can be chosen from the slider depends on the choice.

• n percent of the data: n% of the data will be randomly chosen. The slider ranges in this case from 1 to 100.
• the first n observations: the data set is decreased by only using the first n% records. The slider ranges in this case from 1 to the total number of records.
• every n-th observation: This choice allows to create a simple, systematic sample of input data by selecting every nth observation. The slider ranges in this case from 1 to at max 500.
• exactly n randomly drawn observations: the data set is decreased by taking a random sample of n% records. The slider ranges in this case from 1 to the total number of records.

When the desired selections have been applied, pushing the button Create subset performs the actual sub-subsampling. After the micro data set has been reduced, the user is taken to the Display microdata page where the reduced dataset can be analyzed.

Convert numeric to factor

This page allows to convert numerical variables (numeric or integer) into factors. Users can choose from a range of possibilites on how the factor variable should be generated, ranging from automatic conversion to complete manual control.

By default, two input fields are available. On the left hand side there is a dropdown select field termed Choose numeric variables where the user can select from the list of numeric variables in the input data set. Next to this element, there is are two radio buttons labelled Use custom breaks? with two options, no (the default) and yes. If the no is selected in this input and at least one numeric variable has been clicked from the select input Choose numeric variable(s), a button termed Convert to factor(s) occurs. Pressing this button converts all of the selected numerical variables into factors. Afterwards, the user is taken to the explore variables page where the first of the selected variable(s) is shown.

If, however, the radio buttons Use custom breaks? are set to yes, the layout of the page changes. In this case, the user is able to adjust the way the factor variable should be generated and additional UI elements appear. The first visible change is, that only one numeric variable can now be selected. Now, a list of radio buttons labelled Choose a numeric variable is shown where all available variables are printed below each other. Selecting a specific variable works by clicking on either the variable name or the radio button itself. The next choice the user has to make is in a select input field termed Select algorithm in which equidistant (the default), logEqui, equalAmount or manual are possible values.

The remaining user interface is the same for the first three choices of the Select algorithm input and is slightly different if manual has been selected. In the first case, a numeric input field labelled Specify number of intervals is shown while in the second case a text input field labelled Specify custom breaks occurs right next to the select input field where the algorithm can be selected.

If either equidistant, logEqui or equalAmount are selected, the number specified in the numeric input field defines the number of levels the new factor will have. The difference between the methods are:

• equidistant: uses breakpoints that generate intervals of equal length. The number of records in each interval might differ.
• logEqui: uses breakpoints that generate intervals of equal length based on the log transformation of the data. The number of records in each interval might differ.
• equalAmount: uses breakpoints such that each group/interval has the same number of records. The intervals might be of different length.

Selecting manual allows the user to set the breakpoints manually. Note: make sure that all values are included in the specified intervals. The syntax in this text field is the way that the breakpoints (numbers) have to be entered separated by a colon (,). This sequence of numbers will be interpreted as follows: all values greater than the value before a colon and all values smaller or equal than the value after the colon are grouped together. Any non-matched values will be NA. As an example, entering 1,3,5,9 would create a factor from a numeric variable by grouping together all values in x greater than 1 and less or equal to 3 into the first group, all values greater than 3 and less or equal to 5 into the second group and all values greater than 5 and less or equal to 9 into a third group. Any values in x less or equal than 1 or greater or equal to 10 would be NA. However, -Inf and Inf may be entered as the first or last value to avoid the generation of NAs. Already existing missing values in the numeric input variable will stay NA after the recoding.

What is common for all choices of Select algorithm is that a button labelled Convert to factor appears if the information that has been entered is correct. Also, at the bottom of the page a table with two columns is shown. The first columns shows each of the unique values of the selected variable while the second column shows the number of occurances of this value. On pressing the action button, the selected numeric variable is recoded according the the parameters that have been chosen. After the recode has been done, the current view changes to the explore variable page with the recoded factor variable already being selected.

Convert variables to numeric

In this page, variables of type factor and character from the input data can be converted to numeric variables. If no such variables are present in the microdata, the user is shown this information and no conversion is possible. Otherwise, the user can select one or more variables from the input field labelled Choose variable(s). Once at least one variable is selected, a button called Recode to numeric occurs below the variable selection input. After clicking this button, the conversion is done and the view changes to the explore variable page with the first of the recoded variables being selected.

For variables of type factor, the factor levels are converted to numeric values. Factor levels that cannot be converted to numeric values are replaced with missing values (NA). It should be noted however - as also shown on the GUI - that, for variables of type character, this feature should be used with care because internally, the function as.numeric() is used to perform the conversion. Thus, the resulting numeric vector contains the underlying numeric (integer) representation of the input vector.

Modify factor variable

When this option has been selected from the left hand sidebar, it is possible to modify existing factor variables. The most common use case is to combine one or more levels of the factor. The other use case is to rename single factor levels. In order to proceed, the user must first select an existing factor variable from the select input labelled Choose factor variable. Below this box, there is another input termed Select Levels to recode/combine. In this input, all the levels of the active factor variable can be choosen by clicking on the are selectable. Already selected levels may be removed again by clicking on them with the mouse and pressing either the “backspace”- or “delete” keys on the keyboard.

If at least one factor level is selected, a text input called New label for recoded values as well as a radio input labelled Add missing values to new factor level? appear. By default, the textbox containing the name of the new level is computed by joining the selected factor levels together using the character _ as separator. By clicking into this text field, users can also start to enter a custom name for the new factor level. If only one level has been selected in Select Levels to recode/combine, entering a value different than the default value in this input leads to renaming of this specific factor level. The radio button input labelled Add missing values to new factor level? is set to no by default. If it is changed to yes, any missing (NA) values in the factor are added to the new level.

Below these input fields a button labelled Group factor levels and a barplot showing the absolute number of the current levels of the factors are shown. Pressing the action button results in updating the factor. In this case, the page refreshes and the plot adjusts the the changes that have been applied.

Create a stratification variable

On this page, the user is able to generate a new variable based on two ore more variables from the current micro data. The reason for this is that several anonymization techiques that are explained here and here can by applied independently to subgroups of the input data that are given by the values of a so called stratification variable. This page allows to create such a variable in a convinient way.

The user has to specify at least two variables in the select field labelled Select variables to generate a stratification variable. From this field, all variables that are available in the micro data set can possibly be selected. Once two or more variables are selected, two new inputs appear. The first one appears right next to the variable selection field and is called Specify variable name for stratification variable. In this field, user can enter a desired name for the new variable. By default, the variable name listed consists of the selected variables chained together using _ as separator. By clicking into the field, the user can enter a customized variable name. If the current value in this text input field is not the name of an already existing variable, a button termed Create stratification variable appears below. Clicking on this button adds the new variable to the input data set. The variable is generated as a factor variable in which the values of the contributing variables are also chained together using _ as the separator. After pressing the button, the page changes to the explore variable page where the newly generated variable is already selected.

Set specific values to NA

In this section, users can set values in some variables to missing (NA). The first step is to choose one of two possible methods by choosing either by record ID (the default selection) or by value in the radio button input labelled How do you want to select the cells to be recoded to missing? on top of the page.

If by record ID has been selected, the user can set values in one or more variables for a specific record to missing. He therefore needs to select at least one variable in the input called Select variable. Once at least one variable has been selected, a new input field occurs. In this input called Select record ID, a number between 1 and at most the number of records can be specified. This selection refers to the row in which for the selected variables the values will be set to NA. The user can change this index either by clicking on the small arrows at the right hand side of the input field which allow to increment or decrement the current number by one. As an alternative, it is also possible to directly enter a number in the field.

In case by value has been selected, these choices are slightly different. In the variable selection it is only possible to select one variable. The other difference is that there is no input field where the user can select a number. Instead, there is a dropdown field where the user can select one of the distinct values of the selected variable. The idea is that all records having this values in the selected variable will the set to NA.

The remaining part of this page is identical for both choices of the method. Below these inputs, an interactive table showing the current microdata is shown. This table can be filtered and navigated exactly the same way as already described here. If all selections are valid, a button labelled Set values to NA is shown above this table. Pressing this button sets the correspondig values to NA in the micro data. Afterwards, the page changes and the Exlore variables page is shown. In this page, the (first) selected variable in which values should be set to missing is pre-selected to be analyzed.

Hierarchical data

In this page, users find the functionality to deal with hierarchical data. The idea is as follows. Often data contain clusters, eg. individual within households or students within classes. In this case, it is often the case that some variables of the data set are only relevant on cluster-level while others are relevant on individual level. It is also often the case that one wants to apply different anonymization strategies for the different levels of the data. So the GUI offers a way to deal with this situation in the following way.

The radio buttons labelled What do you want to do? allow to choose from Prepare file for the anonymization of household level variables (the default) and Merge an anonymized household level file into the full dataset. In the former case, the uploaded micro data set can be restricted to those variables relevant for the cluster-level only. Once that has been done, the user may anonymize the household file and can finally export the anonymized file to disk as described here. In the latter case, an already exported, anonymized household-level file can be imported to the GUI and merged with the individual level file. Then the anonymization process can be started by creating a problem instance using individual-level variables as keys. Finally, the user is able to export an anonymized file that is safe on both levels. We now describe both possibilities in this section:

Prepare file for the anonymization of household level variables

In case the goal is to prepare a household-level file, the user first needs to select an identifier for the households or clusters. This select input termed Select the household id variable is initially empty. Once a variable has been selected from the list of all variables available from the input data, an additional select field called Please select all variables that refer to households and not to individuals appears next to it. In this input, one or more variables that are relevant for households only (that means, these variables feature the contain the same values for each household) can be selected. Once at least one additional variable has been chosen, a button labelled Create household-input data is shown below. Clicking on this button restricts the current data set to the selected variables and to only one (the first) record for each value of the cluster identificator. Finally, the page refreshes and the number of observations and variables in the updated, household level data set is shown. Additionally, the names of the variables as well as their type are presented in tabular format.

Merge an anonymized household level file into the full dataset

In this case, the goal is to merge an already anonymized household level file to the currently available data file. This procedure is performed in two steps. In the first step, the user needs to click on the Browse button to select the anonymized file that should be merged. Once the Open button is clicked the file is uploaded immediately. We note here that it is only possible to upload data that have been exported as .rdata-files as described here. After pressing the button, the file will be uploaded to the system. If an error occured (e.g the selected data file does not contain a data frame or if the data set does not contain any variables that overlap with the current inputdata) an error message is shown and the user may upload a different file from disk.

Once the file is successfully uploaded, the layout of the page changes too. A button labelled Reset uploaded household data appears which allows to reset the household level data and makes it possible to upload yet another file. Additionally, a dropdown field labelled Select a variable containing household ids appears. In this input, the user needs to select a variable from the list of variables that are available from both datasets containing the identification variable. The selected variable will finally be used to merge the datasets. Below this selection, a button termed Merge household- and individual level data is shown. On clicking this button, the merge is performed. If everything went well, the page refreshes and the number of observations and variables in the updated micro data file shown. Additionally, the names of the variables as well as their type are presented in tabular format.

View/Analyze existing sdcProblem

This page allows the user to view the current anonymization state. In the Show summary page, a lot of detailed information about the current problem instance is shown. After applying anonymization techniques, the GUI often changes to this page so that it is easily possible to check what has changed.

Furthermore, it is also possible to explore the variables within the current problem or to modify the problem instance by linking variables to some categorical key variables as described or to create random identification variables as it is described here.

Anonymize categorical variables

If Anonymize categorical variables has been selected in What do you want to do? in the left sidebar of the screen, the options Recoding, k-Anonymity, PRAM (simple), PRAM (expert) and Supress values with high risk are available from the radio button list termed Choose a Method and will be described below.

Anonymize numerical variables

If Anonymize numerical variables has been selected in What do you want to do? in the left sidebar of the screen in the Anonymize page, the options Top/bottom coding, Microaggregation, Adding Noise and Rank Swapping become available from the radio button list termed Choose a Method. These methods will be described in the subsequent chapters. We note however that only the first choice (Top/bottom coding) is always available. The remaining choices are only visible if numeric key variables are specified when creating the sdc problem as described here.

Information of risk

Here, users can either obtain information on various risk measures based on the categorical key variables; identify risky records; or visualize the individual re-identification risks.

To select what information to view, the user needs to either select Risk measures (the default value), Risky observations or Plot of risks from the radio button list labeled What kind of results do you want to show?.

Risk Measures

Here, the number and percentages of observations that have a higher indidvidual re-identification risk than the main part of the other records is shown for both the initial as well as the anonymized data. The individual re-identification risk is computed based on the selected categorical key variables, and reflects both the frequencies of the keys in the data and the individual sampling weights. A record is said to have a re-identification risk different from the main part of the data if its personal re-identification risk is either larger than the median + two times the Median Absolute Deviation of the distribution of all individual risks (a robust measure) or if it is deemed large. For this, the setting was choosen to be 0.1 (10%).

Also shown is the number (and corresponding percentages) of observations that are expected to be re-identified. This information is shown for the initial dataset as well as the anonymized data set so that comparisons can be easily done. In case a cluster-variable was specified during the setup of the problem instance, the expected number of re-identifications is also shown if the cluster (e.g persons living in households) information is taken into account as well.

Risky observations

This page allows to filter records in the anonymized data set, depending on a threshold for the individual re-identification risk. To do so, the user can select a specific threshold by moving the slider input labeled Minimum risk for to be shown in the table. The slider ranges from 0 (the default value) up to the maximum risk-value currently available in the anonymized data set. If the default value is not changed, all observations are marked as “risky” because the re-identification risk is by default larger than 0. Below the slider, the number and percentages of observations with individual re-identification risks larger than the currently specified threshold are shown. Below, a table containing the categorical key variables, the numbers of fk, Fk and the individual risk itself are shown for the observations that are marked as “risky”. Once the value of the threshold is changed, the number of risky observations will decrease.

Plot of risks

On this page, two plots are presented. The first histogram shows the distribution of the individual re-identification risks in the anonymized data set, while the plot below it shows the same information based on the original data set that was used when the problem instance was created.

Suda2 risk measure

On this page, users can apply the SUDA algorithm. This algorithm can be used to search for Minimum Sample Uniques (MSU) in the data given the current set of key variables. The algorithm looks at those records that are unique in the sample (sample uniques), and checks if any of these sample uniques are also special uniques. Special uniques are defined as records having keys for which also a subset of the selected key variables is unique in the sample. See the help files for more information on SUDA scores.

We note that this algorithm can only be applied if the current problem instance features three or more categorical key variables. If this requirement is not fulfilled, this information is shown to the user. Else, the user needs to choose a value for parameter disFraction? which is the sampling fraction for the simple random sampling or the common sampling fraction for stratified sampling used within the algorithm. By default, this value is set to 0.01 and can be changed by modifying the slider labeled Specify the sampling fraction for the stratified sampling.

After pressing the button termed Calculate suda2-scores, the actual computation is performed. Once computation is complete, the layout of the page changes. On top of the page a button labeled Reset to choose a different sampling fraction parameter. Pressing this button resets the results and allows to recompute the suda2 scores using a different value for parameter disFraction. Below this button, two tables are shown. The first table summarizes the suda2 scores that have been obtained. It shows for 0 and 8 intervals the number of records having suda2 scores of this value or within a specific interval. The second table shows for each categorical key variable how much of the total risk is contributed to by each of the variables. This amount is shown in the second column (contribution) while the corresponding key variable is listed in column variable.

l-Diversity risk measure

Here you can compute the l-diversity of sensitive variables. A dataset satisfies l-diversity if for every combination of the categorical key variables there are at least l different values for each of the sensitive variables. The statistics refer to the value of l for each record. To calculate this risk measure, the user needs to first select at least one sensitive variable. This can be done in the input field Select one or more sensitive variables where all variables except for the categorical key variables can be selected. The other choice is to set a value for the l-diversity constant which can be done using the slider named Select a value for the recursive constant. This constant is used to determine if a record is unsafe. If the calculated value for l-diversity for a record (having a specific key) is less than this constant, it is said to violate l-diversity.

Once the parameters are set, a button labeled Calculate l-diversity risk measure appears below. Pressing this button forces the calculation of the measure using the selected sensible variables and the constant. Once the calculation is finished, the content of the page changes. At the top of the page, a button named Reset to choose different input parameters is shown. Pressing this button resets the results and allows to specify other parameters. Below, a table containing for each selected sensible variable the 5-number summary of the calculated l-diversity measure. Below that, all the records that violate l-diversity based on the choice of the recursive constant are displayed in an interactive table. If all records are safe, no table is shown.

Barplot/Mosaicplot

On this page it is possible to graphically compare key variables before and after the anonymization. In the select input labeled Variable 1, the first categorical key variable is already pre-selected while the value of the second input field Variable 2 has the default value of none. If only one variable is specified, users are presented with two graphs below these inputs. First, we see a barplot of the original data as it was when the problem instance was created. Below that, another barplot showing the anonymized variable is shown.

If the value in Variable 2 is different from none, the two graphs change. In this case a mosaicplot of the two selected variables is shown for both the original and the anonymized variables.

Tabulations

In this part of the interface it is possible to compare tabulations of categorical key variables before and after the anonymization. The page is built identically as the Barplot/Mosaicplot page. The only difference is that no graphs but tables are displayed below the input fields where the relevant variables can be selected. Also, the tables are shown next to each other to allow for easier comparison and less scrolling.

Information loss

Recoding categorical key variables by combining levels leads to information loss. In this section it is possible to compare for each key variable, the effects of recoding. Thus, a table containing the following columns for each categorical key variable is shown:

• keyVar: the name of a categorical key variable
• nrCategories.orig: the number of categories in the original variable
• nrCategories.mod: the number of categories in the anonymized variable
• mean.size.orig: the mean number of elements in each category in the original variable
• mean.size.mod: the mean number of elements in each category in the anonymized variable
• min.size.orig: the size of the smallest category in the original variable
• min.size.mod: the size of the smallest category in the anonymized variable

The table is interactive and in case of many key variables, it can be sorted by clicking on the small arrow signs that are shown next to the column names.

Obs violating k-Anon

On this page it is possible to find out how many records in the anonymized dataset violate k-anonymity for different choices of k. There is a slider input labeled Select value for 'k' that can take values between 1 and 50. Dragging the slider with the mouse or changing the value of the slider with the arrow-keys on the keyboard leads to a recalculation of the number and percentage of observations that violate k-anonymity for the current choice of k. This information is printed on the screen below the slider.

Furthermore, a table listing all the observations in the dataset that violate k-anonymity is printed. For these observations, the interactive table contains all categorical key variables. Here you can browse the records that violate k-anonymity for the selected level of k. All categorical key variables are shown as well as risk (the individual risk), fk (the frequency of the particular combination of key variables for each record in the sample) and Fk (the estimated frequency of this combination of key variables for each record in the population, taking sampling weights into account) are shown.

Compare summary statistics

In this section the user can compare the distribution of the numerical key variables in the current problem, between the original and the anonymized data. The user can also calculate the available measures given the label of a categorical key variable. To start, the user needs to select a numerical key variable from the select input field labeled Choose a numerical key variable. Only pre-selected numerical key variables are available in this field. Next to this input is another select input field labeled Optionally choose a categorical variable. Its default value is None. In this input field, users may select one of the categorical key variables. If the default value is not changed, the summary statistics shown in tabular form below are calculated for each level of the specified categorical key variable.

Once these selections have been made, some important values are printed in a section named Measures below. These values include the Pearson correlation coefficient using pairwise complete information, the standard deviations as well as the interquartile range (a robust measure being the difference between 3rd and 1st quantile of the data set) of the selected variable in the original and the anonymized data set.

Below this information, two tables are presented. The first refers to the original data and shows the Minimum, Mean, Median, Maximum as well as the 5%-, 25%-, 75%- and 95%-quantiles of the selected numerical key variable while the same information is shown in the table below for the variable in the anonymized data set. In case that a categorical variable has been choosen in Optionally choose a categorical variable, these summary statistics are calculated for each level of the selected categorical key variable. We note that since the levels of the categorical key variables might differ beetween original and anonymized data set, it is not possible to show this information in a single table.

Disclosure Risk

On this page, users can check on the estimated disclosure risk for the selected numerical key variables. The measure can be interpreted in the following way. In the original, unmodified data that has been used to create the sdc problem, the risk for the numeric key variables is assumed to be between 0% and 100%. The more data anonymization techniques such as microaggregation or adding noise are applied to the data, the less the upper bound of the risk will be. So users can compare the estimated upper bound of the risk for numerical key variables in the anonymized data and compare on how much it has reduced from the initial value of 100%. We note that the larger the deviations from the original data are, the lower the upper risk bound will be. However, this has of course also an impact on data utility measures that can be assessed from the menu button Information loss as described below.

Information loss

Here, users can check on two measures of information loss, IL1s and differences in eigenvalues. Generally speaking, the more the numerical key variables are modified (anonymized), the higher the information loss values for both measures. We also note that information loss and disclosure risk for numerical variables are always a trade of which need to be balanced.

Also shown on this page, are the values of the IL1s measure (definition provided) as well as the differences of robust eigenvalues of the data before and after the anonymization process.