Perturbation Methods for Protection of Sensitive Location Data: Smartphone Travel Survey Case Study

Abstract

Smartphone based travel data collection has become an important tool for the analysis of transportation systems. Interest in sharing travel survey data has gained popularity in recent years as “open data initiatives” by governments seek to allow the public to use these data, and hopefully to contribute their findings and analysis to the public sphere. The public release of such precise information, particularly location data such as place of residence, opens the risk of privacy violation. At the same time, in order for such data to be useful, as much spatial resolution as possible is desirable for utility in transportation applications and travel demand modeling. This paper evaluates the efficacy of two geographic random perturbation methods—geo-indistinguishability and donut geomask—in protecting the privacy of respondents whose residential location may be published. The study measures the performance of location privacy methods, preservation of utility, and randomness in the distribution of perturbation distances with varying parameters. It is found that both methods produce distributions of spatial perturbations that conform closely to common probability distributions and, as a result, that the original locations can be inferred with little information and a high degree of precision. It is also found that while achieved k -estimate anonymity increases linearly with desired anonymity for the donut geomask, geo-indistinguishability is highly dependent upon its privacy budget factor and is not very effective at assuring desired achieved k -estimate anonymity.