Privacy — What Aggregation Cannot Hide

In the mid-1990s a state insurance commission released hospital records for research, carefully "anonymised" — names and addresses stripped out, leaving only medical details plus a few innocuous-looking fields: date of birth, sex, ZIP code. A graduate student bought the public voter roll for the state capital, which carried those same three fields alongside every voter's name, and joined the two. One record matched the sitting governor. She mailed him his own health records. Nobody had broken in; nobody had cracked a code. The "anonymous" data had never been anonymous — it only looked that way until someone lined it up against a second list everyone could buy.

That is the failure this module exists to prevent: the confident belief that deleting the obvious identifiers makes data safe to share. It does not. Privacy is normative — a person has a right not to be picked out of a crowd they were promised they had blended into — and it is also technical, because whether they blend in depends on arithmetic about how many others share their details. We build the attack that unmasked the governor on a four-row example you can check by hand, then the two defences — k-anonymity and small-cell suppression — and the trap that catches people who apply the defences carelessly.