PINQ and differential privacy function by returning noisy answers on aggregate questions. If, for example, I’m creating the super-duper-movie-recommender app, my app (as you point out) needs specific users’ lists of movies in order to function, so I don’t see an application of differential privacy there. I also don’t really see any need for anonymization at the point of the “get movies” question. It reminds me of signing up for an account at Amazon—I give them my address and while I certainly don’t want them to release it, they obviously need my exact address in order to provide the service.

Perhaps after you have a database of users and their favorite movies, you could use an anonymization method. Let’s say my app has a very simple, naïve recommender algorithm, which takes my two favorite movies and provides a list of recommendations by taking the set of people who share my favorites, and then for each movie, counting the number of people in that set who also like that movie.

Let’s say your two favorite movies are Star Wars and The Muppet Movie. Those are in my list too! So your recommendations would include all of my favorite movies with frequency at least 1 (depending on how many other people in the set liked that movie).

Here’s where something like differential privacy could possibly come into play. Let’s say one of my favorites is Follow That Bird and that creates a unique combination so it would only have frequency 1. If we use differential privacy to add noise to these counts, the noisy frequencies mean that a frequency near 1 is indistinguishable from a frequency near 0, thus making it impossible to deduce whether or not Follow That Bird is actually a recommendation. On the other hand, if 100 people in your set also like Return of the Jedi, its noisy frequency will be near 100. You won’t be able to tell if it’s actually 100 people vs. 99 or 101, but you’ll know that a lot more people also like it as compared to the movies with much lower noisy answers.

That’s a toy example to demonstrate differential privacy vs. ‘make this set private.’ You should also check out Graham Cormode’s work on “Anonymization and Uncertainty in Social Network Data”, which deals with introducing uncertainty into a graph, and then allows for more ‘hand’s on’ analysis than just returning noisy aggregates.

http://blog.myplaceinthecrowd.org/2010/06/10/exploding-manholes-and-anonymizing-relationships-at-ccicada/

“The services collecting and using data don’t really care about you the individual, they only care about trends and aggregates.”

Facebook applications *probably* constitute the most prevalent/common form of personal data release [period] and magnitude of data (30 million objects and approximately 1 trillion relationships created per month). And in almost all cases in which personal data is used for a legitimate reason (including advertising) the application IS interested primarily in the individual and only in the trends/aggregates to the extent that they distinguish the individual.

So for example, If I like movies A, B, C, and D which together identify me, could I use pinq to anonymize this set and return something to the application that doesn’t identify me?

http://www.nsf.gov/awardsearch/showAward.do?AwardNumber=0941553
http://www.nsf.gov/awardsearch/showAward.do?AwardNumber=0941226
http://www.nsf.gov/awardsearch/showAward.do?AwardNumber=0941518

There were also quite a few smaller awards (on the order of $300k-$500k) handed out by the Trustworthy Computing program over the last few years on topics closely related to data privacy (and even specifically on differential privacy).

And Brad Malin from Vanderbilt, who works on the confidentiality of medical information, was nominated this year for a PECASE (Presidential Early Career Award for Scientists and Engineers) by the NIH.

All in all, the federal funding agencies seem to have recognized the importance of the topic…