Sharing Survivor Data Without Putting Anyone at Risk

Organizations that serve survivors of domestic violence, sexual assault, stalking and trafficking are asked for data constantly: by funders, grant programs, researchers and lawmakers who want to know what works. Sharing it can bring in money and change policy. But if a single client can be identified, the harm is not embarrassment. It can mean an abuser finding them.

Deleting names is not enough. A record like woman, 30s, Spanish-speaking, three children, ZIP 890xx, referred by a hospital can describe exactly one person in a small community. k-anonymity measures that: for each record, k is how many shared records have the same profile. k = 1 means the record is unique. A common bar is k ≥ 5.

k only counts how many people share a profile. It does not check what they share. In 16 records that pass the k ≥ 5 bar, every client in the group has the same service need. Someone who knows a person fits that profile learns their service need (for example, that they are a trafficking survivor) without ever finding their row. Checking for groups like this, called l-diversity, is the step most releases skip.

The last recipe above, plus one more rule: any client still in a group smaller than five is withheld entirely. That removes 138 of 4,000 records (3.5%) and leaves 3,862 records where every client shares a profile with at least four others. Both the naive and the safer release are published as a dataset (link at the bottom of the page), so the difference is there to inspect.

Safety first. Federal grant rules under the Violence Against Women Act already restrict sharing survivors' personally identifying information. This measures whether a "de-identified" file actually protects people, instead of assuming it does.

Better evidence for policy. Measuring risk lets an organization share more, not less: outcome data that funders and legislators need, in a form that protects the people behind it.

No recipe gets to zero. Small communities, less common languages and large families stand out. Each release should be measured, and aggregated counts are the right choice when rows cannot be made safe.

The records are synthetic: every field is randomly generated for a fictional organization, so no real person appears. Proportions (gender, language, referral source, service need) are illustrative skews chosen to resemble a Las Vegas-area caseload, not figures from any real provider.

Method: remove direct identifiers, keep the first three ZIP digits, bin age to 10 years, then count group sizes over six quasi-identifiers (age band, ZIP3, gender, language, children, referral source). Service need and housing outcome are treated as sensitive values, not identifiers.