The enormous data sharing and data availability on the Internet provides opportunities for new services tailored to extract, search, aggregate, and mine data in meaningful ways, At the same time, it poses challenges with regards to data privacy. This paper offers insight into this problem, focusing on current relevant research and potential areas of synergy between the information retrieval community and the privacy community. We then analyze example publicly shared data and discuss the types of data that can be extracted, the methods used for extracting them, and the implications for individuals who share personal information.
We are living in an era of enormous data sharing and data availability on the Internet. This data pervasiveness has resulted in the emergence of services tailored to extract, search, aggregate, and mine data in meaningful ways. On the one hand, this is a boon for information retrieval researchers. The flow of large volumes of textual data offers the perfect playground for developing new search and retrieval algorithms. On the other hand, the sharing of large amounts of data, some of which are sensitive, presents challenges with regards to data privacy. First, because of privacy laws, these data are not always available to researchers. Second, even if the data are readily available, what are the ethics of using data without explicit consent from the data owner? We understand the need for consent for private data, but what about public data? While legal, is it ethical? It is unclear about how the public feels about the sharing of their search results and it is even more unclear what researchers should do to mitigate potential concerns. What techniques exist to efficiently and effectively anonymize the data so that researchers can still work on traditional information retrieval tasks using personalized information? This dilemma leads us to the main question discussed in this paper. How do we protect the privacy of individuals while accessing and gathering this data to improve information retrieval algorithms and methods?
There are a number of privacy models that have been proposed in the literature and are relevant to our community. Here we present some of the most relevant.
Leakage Across Social Network Sites: Understanding the data
that users are willing to share and the level of sensitivity
associated with it is a growing area of research. More specifically, a
number of researchers are investigating how easy it is to link an
individual across online social networks (OSNs) [
Re-identification: Many companies and government agencies
are either required by law or wish to release anonymized versions
of their data. Unfortunately, given the amount of public data
available, sometimes it is possible to un-anonymize the anonymized
data. The goal of re-identification is to match or link anonymized
personal data to publicly available data in order to determine
sensitive data values of users in the anonymized data. In this threat
model, the adversary has access to an anonymized data set and
one or more public data sources containing a large sample of user
data. The anonymized data usually contains sensitive data fields
that if matched to an individual, would result in a significant privacy
breach. The public data source generally contains benign data, i.e.
fields that are not considered sensitive. Researchers have
successfully shown that re-identification is possible with voting records,
with data from OSNs, and with released medical data [
Data Publishing: When sensitive data needs to be released or published, companies must consider different approaches for maintaining confidentiality. Standard approaches include anonymization, adding noise to the data, binning data, and suppressing parts of the data. While many approaches have been proposed for relational data [8] and graph data [10], very few studies have investigated ways to anonymize textual data. The lack of research in this area is not surprising since text data has been readily available for years. Only in the last five to ten years have companies begun limiting access to their weblogs, search data, etc. These limitations, while understandable, limit the progress of research by limiting access to large, corporate data sets. Therefore, developing anonymization strategies that are optimized for text corpora is an important area of research.
Differential Privacy: Government agencies like the Census
Bureau maintain statistical databases that by law need to be accessible
to the public. In the case of the Census Bureau, their databases
contain survey data results. These results need to be shared with the
public without violating the privacy of the individuals who took the
survey. While the Census Bureau uses many different techniques to
maintain the privacy of individuals, many companies are
developing techniques that follow the principles of differential privacy [
As a proof of concept, for the types of information that can be extracted using natural language processing (NLP) methods, we analyze a single LinkedIn profile. Before analyzing text fields, we mention that we can obtain up to 18 different types of data from each user including first name, last name, occupation, picture, education, location, skill, and company. These fields can be fairly unique if a single user shares all of them. Even more important is that once text analysis is conducted on the summary that many LinkedIn users provide, the amount of additional information that can be learned about the user can really increase. As an example, let us consider the following LinkedIn summary. Note that identifying attributes of this text passage have been replaced with dummy values to maintain privacy.
... at A Company, i support our clients by developing marketing and media plans, implementing social media campaigns, overseeing inbound marketing initiatives, and crafting the perfect pitches and press releases to secure news coverage. before joining the agency, i was involved in public relations, promotions and event planning for health care, government and education organizations. i assisted in planning and promoting fund raising events for a regional hospital foundation, and developed communication materials for various hospital programs. while in graduate school, i conducted research for B university on topics including nonprofits and crisis communication, public relations theory, and social media usage among nonprofits. i earned a ba in communication studies with a concentration in journalism from the C university, and a ms in public relations from D university. i wrote my masters thesis on corporate health diplomacy, where i reviewed the corporate social responsibility and business development efforts of pharmaceutical companies examined by international public relations literature ...
For this user produced introduction paragraph in LinkedIn, some
sensitive information can be extracted by the following procedure.
First, we can apply part-of-speech tagging, shallow parsing, and
named entity tagging on the paragraph. We obtain a list of noun
phrases, such as “marketing and media plans", “social media
campaigns", and “public relations". We also obtain a list of named
entities, such as “A company", “C university", and “D university".
Next, we compare the members in the noun phrase list as well as
the members in the named entity list with a general ontology
maintained by us. The ontology keeps a dictionary of terms that
indicates various important aspects for a person. For instance, terms
that indicate a person’s professional degree could be “ba", “ma",
“phd", “mba", etc. Terms that indicate a person’s profession could
be “sde", “accountant", ‘cpa", etc. The ontology is created by
extracting terms and relations from Wikipedia hierarchies via an
automatic approach [
Then, if a free text paragraph contains many terms from the keyword term list for a certain aspect, we will determine whether the paragraph should be classified into one or more aspects. The category of the paragraph can thus be detected by text classification techniques [9]. The name of the resulting category can then be used to trigger the corresponding set of lexico-syntactic patterns. The purpose is to extract detailed information for a category. For instance, using the pattern “ms in NP from NE_university", we can obtain the Master of Science degree of a person in a university, if we keep NP in this example as a place holder. We can also obtain the name of the university where a person went to study Master 4.
Given the volume of blogs, tweets, and other textual personal data shared by users, it is time for our community to consider how data privacy will affect our field. We need to develop protocols for useful anonymized data sets that are non-invasive in terms of individual privacy. We need to understand what types of data can be learned by adversaries using textual data and better understand the sensitivity of learning these data. This is a time for the IR community to get involved in privacy research. 5.
This research was supported by NSF grant CNS-1223825. Any opinions, findings, conclusions, or recommendations expressed in this paper are of the authors, and do not necessarily reflect those of the sponsor.