Systems and method for evaluating identity disclosure risks in synthetic personal data

A method of determining matches between records in two datasets, the method comprising:

• generating generalization lattice of quasi-identifier variables used for matching records in the first dataset to records in the second dataset, wherein each node of the generalization lattice uses a generalization of at least one of the quasi-identifier variables;
• processing each node of the generalization lattice to determine if any of the records in the first dataset match records in the second dataset using the generalizations of the lattice node for the quasi-identifier variables;
• after processing each node, removing from further node processing any records in the second dataset that were not matched,
• wherein the lattice nodes are processed from a broadest generalization to a narrowest generalization.

A non-transitory computer readable media storing instructions which when executed by a processor perform a method comprising:

• receiving a set of real sample records each of the real sample records associated with a respective individual in a population;
• receiving a set of synthetic sample records;
• determining if there is a match between synthetic records and real sample records;
• for real sample records determined to match synthetic records, determining probabilities of matching the matched real sample records to individuals;
• and
• determining an identity disclosure risk for the synthetic sample data based on the probability of matching the matched real sample records to individual.