In the big data era, personal data is, recently, perceived as a new oil or currency in the digital world. Both public and private sectors wish to use such data for studies and businesses. However, access to such data is restricted due to privacy issues. Seeing the commercial opportunities in gaps between demand and supply, the notion of personal data market is introduced. While there are several challenges associated with rendering such a market operational, we focus on two main technical challenges: (1) How should personal data be fairly traded under a similar e-commerce platform? (2) How much should personal data be worth in trade? In this paper, we propose a practical personal data trading framework that strikes a balance between money and privacy. To acquire insight on user preferences, we first conduct an online survey on human attitude toward privacy and interest in personal data trading. Second, we identify five key principles of the personal data trading central to designing a reasonable trading framework and pricing mechanism. Third, we propose a reasonable trading framework for personal data, which provides an overview of how data are traded. Fourth, we propose a balanced pricing mechanism that computes the query price and perturbed results for data buyers and compensation for data owners (whose data are used) as a function of their privacy loss. Finally, we conduct an experiment on our balanced pricing mechanism, and the result shows that our balanced pricing mechanism performs significantly better than the baseline mechanism.
• Security and privacy → Economics of security and privacy; Usability in security and privacy;
Personal data is, recently, perceived as a new oil or currency in
the digital world. A massive volume of personal data is constantly
produced and collected every second (i.e., via smart devices, search
engines, sensors, social network services, etc.). These personal data
are extraordinarily valuable for the public and private sector to
improve their products or services. However, personal data reflect
the unique value and identity of each individual; therefore, the
access to personal data is highly restricted. For this reason, some
large Internet companies and social network services provide free
services in exchange for their users’ personal data. Demand for
personal data for research and business purposes excessively increases
while there is practically no safe and eficient supply of personal
data. Seeing the commercial opportunities rooted in gaps between
demand and supply, the notion of personal data market is
introduced. This notion has transformed perceptions of personal data
as an undisclosed type to a commodity, as noted in [
The personal data market is a sound platform for securing the
personal data trading. What is traded as defined in [
In observing the published results of true statistical data, an
adversary with some background knowledge (i.e., sex, birth date,
zip code, etc.) on an individual in the dataset can perform linkage
attacks to identify whether that person is included in the results.
For instance, published anonymized medical encounter data were
once matched with voter registration records (i.e., birth date, sex,
zip code, etc.) to identify the medical records of the governor of
Massachussetts, as explained in [
As is shown in Figure 1, three main participants are involved: data owners, data seekers/buyers, and market maker. Data owners contribute their personal data and receive appropriate monetary compensation. Data buyers pay a certain amount of money to obtain their desirable noisy statistical data. Market maker is a trusted mediator between the two key players, as no direct trading occurs between two parties. A market maker is entrusted to compute a query answer, calculate query price for buyers and compensation for owners, and most importantly design a variety of payment schemes for owners to choose from.
The personal data market could be considered as the integration of Consumer-to-Business (C2B) and Business-to-Consumer (B2C) or Business-to-Business (B2B) e-commerce. On one side of the trading, the data owners as individuals provide their personal data to the market as is done in (C2B) e-commerce, though, at this point, no trading is done. On another end of the framework, the market maker sells statistical information to data buyers as an individual or company which is similar to (B2C) and (B2B) trading. This is when the trading transactions are completed in this framework. The study of such a market framework could initiate a new perception on the new forms of e-commerce.
The existence of personal data market will make abundance of personal data including sensitive but useful data safely available for various uses, giving rise to many sophisticated developments and innovations. For this reason, several start-up companies have developed online personal data trading sites and mobile applications following this market orientation. These sites are Personal1, and Datacoup2, which aim at creating personal data vaults. They buy the raw personal data from each data owner and compensate them accordingly. However, some data owners are not convinced to sell their raw data (without perturbation). For Datacoup, payment is fixed at approximately $8 for SNS and financial data (i.e., credit/debit card transactions). It is questionable whether $8 is reasonable compensation, and how this price was decided. Another source of ineficiency is related to the absence of data buyers. This can create problems if buyers are not interested in such types of collected data. In addition, CitizenMe and digi.me recently launched personal data collection mobile applications that help data owners collect and store all of their personal data in their devices. Although the framework connects buyers to data owners, it might be ineficient and impractical for buyers to buy individual raw data one at a time. Moreover, as no pricing mechanism is ofered, data owners 1www.personal.com 2www.datacoup.com and buyers must negotiate the prices on their own, which may not be eficient because not all data owners know or truthfully report the price of their data. This can result in an obstruction of trading operations. Based on lessons learned from such start-ups, we can conclude what they are missing is a well-designed trading framework, that explains the principles of trading, and pricing mechanism, that balances the money and privacy traded in the market.
To make this market operational, there are many challenges from all disciplines, but we narrow down fundamental technical challenges to two factors: • Trading framework for personal data: How should personal data be fairly traded? In other words, how should a reasonable trading framework be designed to respectively prevent circumvention from buyers on arbitrage pricing and from data owners on untruthful privacy valuation? • Balanced pricing mechanism: How much should personal data be worth? How should a price that balances data owners’ privacy loss and buyers’ payment be computed? This balance is crucial in convincing data owners and data buyers to participate in the personal data market. 1.2
To address the above challenges more precisely, we first conducted
a survey on human attitudes toward privacy and interest in
personal data trading (Section 2). Second, from our survey analysis and
from previous studies, we identify five key principles of personal
data trading (Section 3.1). Third, we propose a reasonable trading
framework (Section 3.2) that provides an overview of how data
are traded and of transactions made before, during, and after trade
occurs. Fourth, we propose a balanced pricing mechanism (Section
4) that computes the price of a noisy aggregated query answer
and that calculates the amount of compensation given to each data
owner (whose data are used) based on his or her actual privacy loss.
The main goal is to balance the benefits and expenses of both data
owners and buyers. This issue has not been addressed in previous
researches. For instance, a theoretical pricing mechanism [
To develop deeper insight into personal data trading and to collect data for our experiment, we conducted an online survey delivered through a crowdsourcing platform. In total, 486 respondents from 46 diferent states throughout the USA took part in the survey. The respondents were aged 14 to older than 54 and had varying education backgrounds, occupations, and incomes. For our survey, respondents were required to answer 11 questions. Due to space limitations, We only discuss the more significant questions posed.
Analysis 1: For four types of personal data: Type 1 (commute type to school/work), Type 2 (yearly income), Type 3 (yearly expense on medical care), Type 4 (bank service you’re using), the following results were obtained.
(a) Can sell Vs. Cannot sell.
(b) How much to sell.
More than 50% of the respondents said they cannot sell the data (see Figure 2a), and more than 50% of those who can sell said that they do not know how much to sell (see Figure 2b).
Most of the participants stated that they do not know how much
their data are worth, highlighting one of the above mentioned
challenges related to the personal data market. Similarly, [
Analysis 2: When asked to sell their anonymized personal data, 49% of respondents said It depends on type of personal data and amount of money, 35% were Not interested, and 16% were Interested (see Figure 3a). However, if providing more privacy protection by both anonymizing and altering (perturbing) real data, more than 50% of the respondents became interested in selling, meaning that more people are now convinced to sell their data under such conditions. (see Figure 3b). (a) Interest in selling anonymized data. (b) Interest in selling both anonymized and altered data.
Anonymization does not convince people to sell their personal data. Providing extra privacy protection via data alteration or perturbation on the anonymized data might make them feel more convinced and safer to sell their data.
Analysis 3: With regard to alteration/perturbation, the
respondents were asked to select their preferred privacy level: {very low,
low, high, very high}, in other words, how much they want to
alter/perturb their real data. A very low level of alteration (low noise
injection) denotes a low privacy protection, but more monetary
compensation. As a result (see Figure 4a), alteration levels were
found to vary across the four types of data. Similarly, the preferred
payment schemes (see Figure 4b) varied throughout all the data
types. A human-centric study [
Privacy protection levels and desired payment schemes varied in between the data considered and among the respondents. In practice, people harbor diferent attitudes toward privacy and money. Thus, it is crucial to allow a personalized privacy level and payment scheme for each individual.
Analysis 4: Among the four given criteria to decide when selling personal data: usage (who and how buyers will use your data), sensitivity (sensitivity of data, i.e., salary, disease, etc.), risks (future risks/impacts), and money (to obtain as much money as possible),
In descending order, the participants valued the following: who and how the data will be used, sensitivity, future risks/impacts, and money (see Figure 5).
Money is considered the least important criterion, while who and how data will be used is considered the most important one when deciding to sell personal data. This implies that money cannot buy everything when the seller does not want to sell. 3
All notations used in this study are summarized in Table 1. 3.1
To design a reasonable trading framework and a balanced pricing mechanism, it is important to determine the chief principles of the personal data trading framework. These key principles are derived from previous studies and from the four key analyses of our survey. The principles are categorized into five diferent groups: personalized diferential privacy as a privacy protection, applicable query type, arbitrage-free pricing model, truthful privacy valuation, and unbiased result. To guarantee the data owner’s privacy, personalized diferential privacy injects some randomness into the result based on the preferred privacy level. It is also used as a metric to quantify the privacy loss of each data owner. With this personalized diferential privacy guarantee, only some certain linear aggregated query types are applicable in this trading framework. Regarding pricing, a pricing model should be arbitrage-free and must not allow any circumventions on the query price from any savvy buyers. Similarly, such a framework should be designed to encourage data Notation ui , bj xi εˆi wi εi wi (εi ) x
Q owners’ truthful privacy valuation by providing them the right pricing scheme so that they will not benefit from any untruthful valuation. Finally, it is important to ensure the generation of unbiased/less biased query result without increasing query price, so a careful sample selection method is crucial.
The pricing mechanism should be capable of preserving data owner’s
privacy from any undesirable privacy leakages. To ensure privacy,
diferential privacy [
Definition 3.1 ( ε-Diferential Privacy [
In regard to diferential privacy (DP), privacy protection is for
the tuple level, which means that all users included in the dataset
have the same privacy protection/loss ε value (one for all).
However, in practice, individuals may have diferent privacy attitude,
as illustrated in our survey result, so allowing privacy
personalization is considered critical, especially in the trading setting. We
thus adopt the personalized diferential privacy (PDP) theory by
[
Definition 3.2 (Personalized Diferential Privacy [
Pr(M(x ) ∈ S) ≤ exp(εˆ) ∗ Pr(M(y) ∈ S) (2)
Both DP and PDP are theories, so a private mechanism is
employed to realize these theories. [
Definition 3.3 (Score Function [
In PDP, each record or data owner has their own privacy setting
εˆi , so it is important to distinguish between diferent D ′ that make
a specific value to become the output. To formalize this mechanism,
[
Definition 3.4 ( P E Mechanism [
1 exp( 2df (D, r , ϕ)) Íq ∈R exp( 21df (D, r , ϕ)) where df (D, r , ϕ) = max Íi ∈D ⊕D′ −ϕiu
f (D′)=r
In our framework, ϕ refers to a set of maximum tolerable privacy
loss εˆi of all data owners in the dataset x . We apply this P E
mechanism to guarantee that each data owner’s privacy is protected
despite data owners having diferent privacy requirements. The
proof of this mechanism can be found in [
With background knowledge, the adversary may engage in linkage
attacks on the published query answer and may eventually identify
an individual from this answer. Therefore, any queries answered in
this trading framework should guarantee that results do not reveal
whether or not an individual is answering the query. DP or PDP
can prevent the data linkage attacks on the published results of
statistical/linear aggregated queries by introducing randomness.
For these reasons, only statistical/linear aggregated queries should
be allowed in the trading framework when the privacy is guaranteed
by DP or PDP. [
Definition 3.5 (Linear Query [
Arbitrage-free is a requisite property used to combat the
circumvention of a savvy data buyer on the query price. For instance, a
perturbed query answer with a larger ε1 = 1 costs $10 and that with
a smaller ε2 = 0.1 costs $0.1. If a savvy buyer seeks a perturbed
query answer with ε = 1, he or she will buy the query answer with
ε2 = 0.1 10 times to compute the average of them for the same result
as ε1 = 1 because ε increases as the number of computation times
n increases ε = (n ∗ ε2). This case is explained based on composition
theorems in [
Definition 3.6 (Arbitrage-free [
π (Qi ) m Õ i=1 (5)
An explanation and discussion of query determinacy (S → Q)
can be found in [
Arbitrage-free pricing function: [
For simplicity, a buyer shall not be able to request the same query more than once because each data owner has his or her own εˆi , so we must guarantee that their privacy loss is no greater than their specified εˆi . Alternatively, market maker can predefine the sets of queries that buyer can ask for so that they can study relationships between all queries in advance to prevent arbitrage problems from emerging. However, this also limits the choice of query buyers can request, so our framework allows buyers to ask any linear aggregated queries but only once per query.
Untruthful privacy valuation is an undesirable property leading to
the generation of unacceptably high query prices. Without carefully
designed payment schemes, some savvy data owners will always
attempt to select any schemes that provide them more benefits,
so they may intentionally report an unreasonably high privacy
valuation. For instance, [
To encourage truthful privacy valuation, all data owners shall be
provided with the suitable payment scheme corresponding to their
privacy/risk attitudes so that untruthful valuations do not increase
their benefits, as illustrated [
Proposition 3.7 (Payment Scheme). A payment scheme is a non-decreasing function w : ε → R+ representing a promise between a market maker and a data owner on how much data owner should be compensated for their actual privacy loss εi . Any non-decreasing functions can be denoted as payment schemes. For instance, • Type A: This Logarithm function is designed to favor conservative (low-risk, low-return) data owners whose εˆ is small. w = loд(30) ∗ ln(9000ε + 1) 130 (6) • Type B: This Sublinear function is designed to favor liberal (high-risk, high-return) data owners whose εˆ is large.
8ε (7) w = √1100 + 500ε2
For our framework, we designed two diferent types of payment schemes, as illustrated in Figure 6. The data owner shall select a payment scheme based on his or her privacy εˆ or risk orientation. Therefore, there is no reason for data owners to untruthfully report their privacy valuation εˆ because doing so would not provide them with any benefits. The market maker designs a pricing scheme, and the guidelines of a design should mainly depend on equilibrium theory of the supply and demand. In the present study, we only consider two types of functions to provide diferent options for conservative and liberal data owners. We will develop a more sophisticated scheme in our future work.
Besides ensuring privacy protection and price optimization, unbiased result has been a crucial factor in trading. Buyers do not want to obtain a result that is biased or that is significantly diferent from the true result, so it is important to ensure the generation of an unbiased result.
In our setting, we guarantee the generation of an unbiased/less biased result by randomly selecting data owners, among which both liberal and conservative data owners are equally likely to be selected. Employing the PDP assumption, data owner’s εˆi value is not correlated with the sensitivity of data, so random selection best guarantees a less biased result.
Moreover, to optimize the query price, it is necessary to select
a representative sample from a dataset because paying each
individual data owner in the dataset (as in [
A personal data trading framework should adopt these five key
principles to avoid certain issues and to obtain more optimal results.
However, a similar study by [
To balance data owners’ privacy loss and data buyer’s payment to guarantee a fair trade, we propose a personal data trading framework (see Figure 7) that involves three main participants: market maker, data owner, and data buyer.
Market maker is a mediator between the data buyer and data owner. Market maker has some coordinating roles. First, market maker serves as a trusted server that answers data buyer’s query by accessing the data elements of data owners. Second, a market maker computes and distributes payment to data owners whose data have been accessed while keeping a small cut of the price as a profit χ . Third, a market maker devises some payment schemes for data owners to choose from. Our pricing mechanism is designed to assist the market maker with his or her tasks.
Data owner sells his/her data element xi by selecting the
maximum tolerable privacy loss εˆi and payment scheme wi . In DP, ε
is a real non-negative value that is dificult to determine to obtain
an exact level of utility. However, [
Data buyer purchases an aggregated query answer from the
market maker by specifying a query Q and a maximum budget
Wmax . Rather than asking the buyer to specify the variance in the
query answer, as in [
Our framework works as follows. Data owner ui (xi , εˆi , wi ), i ∈ [1, n] sells his/her data element xi by demanding that the actual privacy loss εi must not be greater than their specified εˆi while payment should correspond to their selected payment scheme wi . These data elements are stored by a trusted market maker. In the pretrading stage, the data buyer issues a purchase request by specifying his Q and Wmax . With the request, the market maker will run a simulation and generate a price menu (see Table 2) with an average privacy loss ε and a sample size corresponding to prices for the buyer. This price menu provides an overview of the approximate level of utility the buyer may receive for each price.
The buyer reviews the ε and determines the amount of money he is willing to pay. Once the market maker is notified of the purchase decision, he will run the pricing mechanism (described in Section 4) to select a number of representative samples RS from the dataset x and then conduct a query computation by perturbing the answer to ensure the privacy guarantee for all data owners whose data were accessed. Next, the market maker distributes the payment to the data owners in the selected sample RS and returns the perturbed query answer P (Q(x )), the remaining budget Wr , the size of RS, and the root mean squared error RMSE in the query answer. Note that the transaction aborts when the market maker cannot meet their requirements simultaneously. 4
The pricing mechanism directs price and query computations for
data buyers and compensation computation for data owners whose
data have been accessed. A specially designed pricing mechanism is
required in this personal data market because information derived
from personal data, unlike other types of physical goods, does not
have any tangible properties. Thus, it is dificult to set a price or
calculate the traded value as asserted in [
To simply compute the query price, compensation, and perturbed
query result, the baseline pricing mechanism does not involve a
sampling procedure. It basically utilizes the entire dataset x in
computations to ensure the generation of an unbiased result. In addition,
the baseline pricing mechanism implements a simple personalized
diferentially private mechanism known as the Minimum
mechanism [
In the balanced pricing mechanism, computations are conducted through the use of three main algorithms: (1) sample h subsets of data owners, (2) compute the query price and compensation for all h subsets, and (3) perturb the query answer for all h subsets and then select an optimal subset.
Algorithm 1 samples h subsets of data owners. It computes the size of an RS representative sample of a dataset x using the statistical method given a dataset x , a confidence level score CLS, a distribution of the selection DT , and a margin of error MER. Then, the mechanism randomly selects diferent/not-duplicated data owners for all the h diferent subsets. Due to the randomization of data owner selection, the mechanism guarantees an optimal sampling result by increasing the h because an optimal subset RS is selected from all the h diferent subsets. The output of this algorithm is a set of samples (RS1, RS2, ..., RSh ) used as an input in Algorithm 2. Algorithm 1: Sample h subsets of data owners
Input: x, DT , CLS, MER, and h
Output: (RS1, RS2, ..., RSh ) 1 SS ← DTM∗ECRL2S2 ;
SS ∗ |x | ; 2 |RS | ← SS + |x | − 1
4 RSh ← {ui |U ndupRandomize(1, |x |)|i ∈ [1, h]}; 5 h ← h − 1; 6 end
Algorithm 2 computes the query price and compensation for all the h subsets. Given a data buyer’s maximum budget Wmax , query Q, dataset x , number of samples h, number of perturbations Algorithm 2: Compute query price and compensation for all h subsets
Input: x , (RS1, RS2, ..., RSh ), Wmax , χ , h, and Φ
Output: Wp , Wr , and (w1, w2, ..., wh ) 1 Wab ← Wmax − χ ;
3 j ← |RSh |;
Íj Wp ← { i=0 wui ∈RSh (εˆui ∈RSh )|i ∈ [0, j − 1]}; if Wp ≤ Wab then while While j< |x |&& Wp < Wab do
Wr ← Wab − Wp ; RSh ← {uk |U ndupRandomize(1, |x |)}; j ← j + 1; if W r > wuk ∈x (εˆuk ∈x ) then
Wp ← Wp + wuk ∈x (εˆuk ∈x ); εuk ∈x ← εˆuk ∈x ; else end
Wp ← Wp + Wr ; wuk ∈x ← Wr ; εuk ∈x ← (wuk ∈x )−1; end
Wr ← Wab − Wp ; else lsT emp ← RSh ; payment ← 0; Wr ← 0; Weq ← |lsWTeambp | ; do lsU nder Paid ← 0; foreach ui ∈ lsT emp do if wui (εˆui ) ≤ Weq then
εui ← εˆui ; else end payment ← payment + wui (εˆui ); wui ← Weq ; εi ← (wui )−1; lsU nder Paid ← lsU nder Paid + ui ; payment ← payment + Weq ; end Wr ← Wab − payment ;
Wr Weq ← Weq + |lsU nder Paid | lsT emp ← lsU nder Paid; while Wr > 0; ;
Wp ← Wab ; 4 5
RMSEm ← 6 7 end
P (Q(RSm ))k ← {P E Q (x, RSm ) ∗ |R|Sx m| | |k ∈ [0, Φ − 1]}; s ÍΦ k=0(P (Q(x ) − P (Q(RSm ))k )) Φ 2 |k ∈ 8 εmax ← Max (ε1, ε2, ..., εh ); 9 optIndex ← {index |εindex = εmax }; 10 RMSEopt ← RMSEopt I ndex ; 11 P (Q(RS))opt ← P (Q(RS))opt I ndex ; 12 wopt ← wopt I ndex ; Φ, market maker’s benefit χ , and h subsets (RS1, RS2, ..., RSh ) from Algorithm 1, the algorithm returns the query price Wp , remaining budget Wr (if applicable), compensation wi (εi ) for each ui , and average compensation wi for each subset because Algorithm 3 uses this result to select an optimal subset from all h subsets. The algorithm first computes the available budget wab by subtracting χ from the given Wmax . Next, the algorithm computes the total payment Wp required when paying for the maximum privacy loss εˆi of ui ∈ RSh . wui ∈RSh (εˆui ∈RSh ) denotes a payment for data owner ui in RSh for εˆi . When Wp is smaller than Wab , the algorithm pays each ui for εˆi while using Wr to include more data owners into RSh by paying for εˆi or εi < εˆi based on Wr . This process repeats until all Wr = 0 or |RSh | = |x |, as the utility is influenced by both the size of RS and by the privacy loss εi of all ui . Otherwise, when Wp > Wab , the algorithm determines the equal payment Weq for each ui ∈ RSh and then verifies if each ui should be paid exactly Weq or less when wui (εˆui ) < Weq . The updated (RS1, RS2, ..., RSh ) as an output is used in Algorithm 3.
With the output of Algorithm 2, Algorithm 3 perturbs the query answer and selects an optimal subset from all h subsets. It computes the average privacy loss ε and perturbed query result P (Q(RS)) based on the proportional diference between x and RSh by multiplying result of P E by |x |/|RSh |, and RMSE in each (RS1, RS2, ..., RSh ). It then selects an optimal RS with a maximum average privacy loss of εmax denoting a high probability that less random noise is included in the result. Finally, the algorithm finds the corresponding RMSEopt , P (Q(RS))opt and wopt of the optimal RS selected.
At the end, data buyers receive the perturbed query answer P (Q(RS)) along with the remaining budget Wr (when applicable), the number of data owners in RS, and the mean squared error RMSE in the query answer. Data owners are then compensated according to their actual privacy losses εi . 5
Experimental setup: We divide the experiment into two components: (1) the simulation of our balanced pricing mechanism and (2) the comparison of our mechanism with the baseline pricing mechanism. We examine the query price Wp , root mean squared error RMSE, average privacy loss ε and average compensation w that each ui obtained from both mechanisms and then conclude that for the same Wp , which mechanism generates the smallest RMSE value. Due to space constraints, we only show the experimental result of the following count query Q: "How many people commute by personal car in the USA?"
Data preparation: From our survey, we obtained 486 records
of personal data from 486 data owners. To generate more accurate
experimental results, a larger dataset is preferable, so we
duplicated our survey dataset 500 times to obtain a larger dataset x of
243,000 records. To conduct such an experiment, each data record
must have two important variables: the maximum tolerable
privacy loss εˆ and a payment scheme w. For the sake of simplicity,
we assume εˆ ∈ [
Experiment results: We first conduct a simulation of our mechanism (Figure 8) to explain the correlation between the query price and RMSE , between the query price and average privacy loss ε, and between the query price and average compensation value. Figure 8a shows that the RMSE value decreases as the query price increases. This pattern is reasonable in practice because the higher the query price is, the lower the RMSE should be. Remarkably, the RMSE value declines dramatically with query price from $5 to $50 but then gradually and slightly decreases for $50 to $1000. We can attribute this phenomenon to the impact of privacy parameter εi of each data owner ui and to the number |RS | of data owners responding to the query. When the query price is approximately $50 or less, it can only cover the compensation of RS, so with the same size |RS |, an increase in the query price (i.e., $5 to $50) can also increase the ε value in RS. However, when the query price exceeds what is needed to pay for εˆi for all ui in RS, the remaining budget is used to include more data owners in RS, which can significantly or marginally decrease the overall RMSE while increasing the ε value depending on the distribution of data. When more conservative data owners are included in RS, this can afect the ε value resulting in just a minor decrease in RMSE despite more money being spent. For this reason, the price menu plays a crucial role in providing an overview on approximate degree of change in RMSE values corresponding to query prices. In turn, data buyers can decide whether it is worth spending more money for a minor decrease (a) Query price and RMSE. (b) Query price and ε. (c) Query price and average compensation. of RMSE within their available budgets. Figure 8b and Figure 8c show a similar correlation pattern between the query price and ε and between the query price and w. They show that the higher the query price is, the higher ε and w values become. A marginal decrease in ε with a significant rise in query price ($100 to $1000) shown in Figure 8b can be attributed to the phenomenon illustrated in Figure 8a whereby the RMSE value only slightly decreases within a significant price increase.
We next compare the results of our balanced pricing mechanism with those of the baseline pricing mechanism (Figure 9). The experimental results show that our balanced pricing mechanism considerably outperforms the baseline mechanism under almost all conditions. Figure 9a shows that our balanced mechanism produced a noticeably smaller RMSE value for the same query price relative to the baseline mechanism. In particular, our balanced mechanism produced a significantly smaller RMSE value even when the query price was set to be relatively low (i.e., $5) because instead of querying from the entire dataset, our balanced pricing mechanism only queries from a representative sample RS. This reduces the query price while still generating a smaller RMSE. Due to random noise drawn from the Laplace distribution, we can see that the RMSE of the baseline mechanism, rather than declining, rises for query prices $50 to $100. Figure 9b and Figure 9c show a similar pattern in that the ε and w of our balanced pricing mechanism are significantly higher than those of the baseline mechanism. 6
The above listed experiment results show that our balanced pricing mechanism considerably outperforms the baseline pricing mechanism. This is attributed to two main factors. First, we apply an exponential-like P E mechanism (see Definition 3.4) to achieve Personalized Diferential Privacy (PDP) to take advantage of the individual privacy parameter εˆ of data owners, especially of the liberal group. In contrast, the baseline mechanism can only apply a minimum mechanism to achieve PDP by adding a large amount of random noise drawn from Laplace distributions utilizing the smallest εˆ of the entire dataset. Second, our mechanism produces a considerably smaller RMSE for the same query price. In other words, for the same level of utility, we can indeed reduce the query price, as our mechanism only queries a small subset of a dataset while generating unbiased results from a random sampling and selection procedure. we thus exclusively compensate the data owners of the queried subset, while the baseline mechanism must compensate all data owners of a dataset to run a query on the dataset to obtain unbiased results. Therefore, our balanced pricing mechanism is more eficient than the baseline mechanism.
In the price menu, it is important to illustrate trends of higher prices and higher levels of approximate utility (denoted as ε). However, Figure 8b shows a slight decrease in ε from $100 to $1000. This phenomenon could be attributed to the number of samplings h applied in the mechanism. Despite showing a budget increase, it cannot fully guarantee that ε will increase due to the random selection of data owners with various εˆ values. Thus, our naive solution is to increase the price gap in the price menu to guarantee a distinguished increase in ε for an increasing query price. More discussion on this point will be included in our next work.
It is also crucial to ensure that data owners can technically choose
an appropriate maximum tolerable privacy loss εˆi that reflects
their privacy attitude and risk orientation. This problem indeed
remains an open question in the diferential privacy community
regarding how to set the value of ε or εˆ in our setting. Although
[
In the field of pricing mechanism design, there are two crucial
focuses of research: auction-based pricing and query-based pricing.
Auction-based pricing has attracted the attention of [
We analyzed people’s privacy attitude and levels of interest in data trading, then identified five key principles for designing a reasonable personal data trading framework. For an operational market, we proposed a reasonable personal data trading framework based on our key principles. In addition, we proposed a balanced pricing mechanism that balances money with privacy to ofer more utility to both data owners and data buyers without circumvention. Finally, we conducted various experiments to simulate our mechanism and to prove its considerably higher degree of eficiency in comparison to a baseline pricing mechanism. The results show that our study has identified and tackled some radical challenges facing the market, thus facilitating the existence of the personal data market.
Having investigated the challenges of this market, we identify a number of interesting avenues for future work. To obtain an optimal query answer and price, it is crucial to carefully design a payment scheme using game theory. In the present study, we only designed two types of payment schemes for liberal and conservative data owners. We will develop a more sophisticated design in our future work. Moreover, in our study, a market maker is assumed to be a trusted server storing and accessing data owners’ data on their behalf, yet to some extent, trust has become a dificult question to address from both technical and social standpoints. Thus, for future work, we can consider a trading framework and pricing mechanisms in which market makers are assumed to be untrustworthy..
This work was supported through the A. Advanced Research Networks JSPS Core-to-Core Program. The work was also supported through JSPS KAKENHI Grant Numbers 16K12437 and 17H06099.