Attempted Socialism wrote:An idea struck me while trying to find a solution. Have you considered a mandate to state the justification for redaction? Differentiating between "this redacted is for privacy", "this is redacted for national security" and "this is redacted for <third compelling need>", even if only in the broadest terms, would give the public a bit more insight, create slightly more transparency, into the redactions.
I think that's a decent idea; I put it under a "extent practicable" clause, because it would have the same sort of differential privacy concerns that I spoke about above.
Attempted Socialism wrote:This is something I know something about. The US Census justifies differential privacy with similar arguments (as a researcher using government data, it is very annoying). That said, under current wording, if there exists a compelling need for stripping that data, the information would be so stripped.
Perhaps I phrased it poorly -- I'm asking for where you think the limits of compelling need are. If, say, we have a child abuse court case. The identity of the child is protected, but what if evidence used in the trial could, if compiled, hypothetically be used to identify the child? Again, the identity is fairly obvious, but there's a grey area between "obviously private" and "obviously in the public interest" which I'd like you to clarify a bit before I know if the 2ai test hits the mark.
What you're concerned about is a reidentification attack, which is the justification for why the Census talks about differential privacy. Such attacks only became feasible because of the scope of the data that is publicly available about people today. In the past, it would not have been necessary to impose strict limits on releases to prevent reidentification, as the lack of computers and huge publicly available datasets (held by private companies and populated by the users mostly) would have made it effectively impossible to do that. It is much easier to do such an attack today, and I think that's why a flexible standard works best.