System and method for privacy protection using identifiability risk assessment

Abstract

A risk assessment system and method includes an information system configured to disclose information to a third party. A risk determination model is configured to compute identifiability risk for on one or more records in storage. The identifiability risk is compared to a threshold prior to being disclosed wherein the information system is informed of the identifiability risk exceeding the threshold prior to disclosure to the third party.

Description

GOVERNMENT RIGHTS[0001]This invention was made with Government support under Contract No.: H98230-05-3-001 awarded by the U.S. Department of Defense. The Government has certain rights in this invention.BACKGROUND[0002]1. Technical Field[0003]The present invention relates to privacy protection and more particularly to systems and methods employing an identifiability risk assessment to protect against disclosure of protected information.[0004]2. Description of the Related Art[0005]Information systems deployed and maintained by businesses of different sizes often store personal information collected from their clients. Similarly, information systems of government organizations, such as the Internal Revenue Service, store personal data about citizens, as well as other private data collected from businesses. In recent years, these information systems have increasingly become computerized.[0006]Computer-based information systems enable anytime instant access to the data, and on-the-fly cr...

AI Technical Summary

Benefits of technology

[0015]Another risk monitoring system includes an information system configured to disclose information to an entity, and a risk determination model configured to compute identifiability risk for on one or more records in storage. A privacy monitor is configured to receive the one or more records being released, and prior to disclosing the one or more records to the entity, the privacy monitor is configured to detect whether the identifiability risk exceeds a threshold and perform a function to mitigate unauthorized disclosure of the records to the entity.

Problems solved by technology

Together with the benefits that the now ubiquitous digital technologies have brought, they have also brought new dangers.

Currently, it is becoming increasingly easy to gain unauthorized access to personal data.

Identity theft is a very serious and real threat to anyone who is sharing personal information with companies in exchange for services, credit, etc.

These problems include evaluating and managing a tradeoff between privacy protection and business efficiency, and quantifying the privacy risks associated with various business operations.

Privacy policies enacted by organizations restrict the purposes for which the information can be used.

Developing privacy policies is an extremely difficult task that any organization must perform when it establishes a system for storing personal or private information.

It is especially difficult in information systems where automated policy enforcement is implemented, because for such systems, the policy is specified as a set of formal automatically verifiable rules.

Also as a result, the policies mandated internally by an organization are typically more restrictive than the published policies, and reflect not only the law and the published commitments of the organization, but also the best practices requirements as seen by policy writers.

If the internal policy is enforced automatically, such an operation may require the intervention of high-level management to circumvent the normal enforcement controls.

However, the currently existing approaches do not provide sufficient assistance to the organization's employees responsible for making decisions, and often they are forced to violate internal policies in order to get their job done.

Images