Method and device for anonymizing data stored in a database

A non-transitory computer readable data medium storing a computer program including instructions for executing an anonymization method when the instructions are executed by a processor, wherein the method comprises:

• anonymizing initial data stored in a database of a computer system, said initial data resulting from aggregating personal data relating to a plurality of individuals, the anonymizing comprising:
• identifying in the initial data a set of sensitive data, the sensitive data being data that would be affected by personal data relating to an individual being added to or removed from the database;
• partitioning the sensitive data set into a plurality of subsets based on sensitivity of the sensitive data;
• determining a respective sensitivity level for each subset;
• and
• adding noise to the sensitive data of each subset, the added noise having a level that depends on the respective sensitivity level of the subset,
• wherein the anonymization of the initial data renders it impossible to target or to infer information about one of the plurality of individuals using the anonymized initial data, and to know whether the anonymized initial data is associated with one of the plurality of individuals.

An apparatus comprising:

• an anonymizer device for anonymizing initial data stored in a database, the initial data resulting from aggregating personal data relating to a plurality of individuals, the anonymizer device comprising:
• a processor;
• and
• a non-transitory computer readable data medium comprising a computer program stored thereon including instructions, which when executed by the processor configure the anonymizing device to:
• identify in the initial data a set of sensitive data, the sensitive data being data that would be affected by personal data relating to an individual being added to or removed from the database;
• partition the sensitive data set into a plurality of subsets based on sensitivity of the sensitive data;
• determine a respective sensitivity level for each subset;
• and
• add noise to the sensitive data of each subset, the added noise having a level that depends on the respective sensitivity level determined for said each subset,
• wherein the anon ymization of the initial data renders it impossible to target or to infer information about one of the plurality of individuals usin. the anonymized initial data, and to know whether the anonymized initial data. is associated with one of the plurality of individuals.