Anonymisation Models for Text Data: State of the art, Challenges and Future Directions

Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing, pages 4188–4203 August 1–6, 2021. ©2021 Association for Computational Linguistics 4188 Anonymisation Models for Text Data: State of the Art, Challenges and Future Directions Pierre Lison1, Ildik´o Pil´an1, David S´anchez2, Montserrat Batet2, and Lilja Øvrelid3 1Norwegian Computing Center, Oslo, Norway 2Universitat Rovira i Virgili, CYBERCAT, UNESCO Chair in Data Privacy, Spain 3Language Technology Group, University of Oslo, Norway {plison,pilan}@nr.no {david.sanchez,montserrat.batet}@urv.cat liljao@ifi.uio.no Abstract This position paper investigates the problem of automated text anonymisation, which is a pre- requisite for secure sharing of documents con- taining sensitive information about individuals. We summarise the key concepts behind text anonymisation and provide a review of current approaches. Anonymisation methods have so far been developed in two fields with little mu- tual interaction, namely natural language pro- cessing and privacy-preserving data publish- ing. Based on a case study, we outline the ben- efits and limitations of these approaches and discuss a number of open challenges, such as (1) how to account for multiple types of seman- tic inferences, (2) how to strike a balance be- tween disclosure risk and data utility and (3) how to evaluate the quality of the resulting anonymisation. We lay out a case for moving beyond sequence labelling models and incor- porate explicit measures of disclosure risk into the text anonymisation process. 1 Introduction Privacy is a fundamental human right (Art. 12 of the Universal Declaration of Human Rights) and a critical component of any free society, among others to protect citizens against social control, stigmatisation, and threats to political expression. Privacy is also protected by multiple national and international legal frameworks, such as the General Data Protection Regulation (GDPR) introduced in Europe in 2018. This right to privacy imposes constraints on the usage and distribution of data in- cluding personal information, such as emails, court cases or patient records. In particular, personal data cannot be distributed to third parties (or even used for secondary purposes) without legal ground, such as the explicit and informed consent of the individuals to whom the data refers. As informed consent is often difficult to obtain in practice, an alternative is to rely on anonymisa- tion techniques that render personal data no longer personal. Access to anonymised data is a prerequi- site for research advances in many scientific fields, notably in medicine and the social sciences. By fa- cilitating open data initiatives, anonymised data can also help empower citizens and support democratic participation. For structured databases, anonymi- sation can be enforced through well-established privacy models such as k-anonymity (Samarati, 2001; Samarati and Sweeney, 1998) or differen- tial privacy (Dwork et al., 2006). These privacy models and their implementations are, however, difficult to apply to unstructured data such as texts. In fact, text anonymisation has been traditionally enforced manually, a process that is costly, time- consuming and prone to errors (Bier et al., 2009). These limitations led to the development of various computational frameworks …

Content truncated to 500 words