`:top
`!Datafly algorithm`! is an `F33f`_`[algorithm`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Algorithm]`_`f for providing anonymity in medical data. The algorithm was developed by `F33f`_`[Latanya Arvette Sweeney`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Latanya_Arvette_Sweeney]`_`f in 1997−98.`:cite-ref-1[`F5bf`_`[1`#cite-note-1]`_`f]`:cite-ref-2[`F5bf`_`[2`#cite-note-2]`_`f] Anonymization is achieved by automatically generalizing, substituting, inserting, and removing information as appropriate without losing many of the details found within the data. The method can be used on-the-fly in `F33f`_`[role-based`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Role-based_access_control]`_`f security within an institution, and in `F33f`_`[batch`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Batch_processing]`_`f mode for `F33f`_`[exporting data`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Import_and_export_of_data]`_`f from an institution. Organizations release and receive medical data with all explicit `F33f`_`[identifiers`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Identifier]`_`f—such as name—removed, in the erroneous belief that `F33f`_`[patient confidentiality`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Physician–patient_privilege]`_`f is maintained because the resulting data look anonymous. However the remaining data can be used to re-identify individuals by linking or matching the data to other databases or by looking at unique characteristics found in the `F33f`_`[fields`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Field_(computer_science)]`_`f and `F33f`_`[records`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Row_(database)]`_`f of the `F33f`_`[database`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Database]`_`f itself.
The Datafly algorithm has been criticized for trying to achieve anonymization by overgeneralization. The algorithm selects the `F33f`_`[attribute`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Attribute_(computing)]`_`f with the greatest number of distinct `F33f`_`[values`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Value_(computer_science)]`_`f as the one to generalize first.`:cite-ref-3[`F5bf`_`[3`#cite-note-3]`_`f]
>>Contents
• `F0af`_`[Core algorithm`#core-algorithm]`_`f
• `F0af`_`[References`#references]`_`f
• `F0af`_`[External links`#external-links]`_`f
-─
>>Core algorithm
An outline of the Datafly algorithm is presented below.`:cite-ref-4[`F5bf`_`[4`#cite-note-4]`_`f]
`!`F33f`_`[Input`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Input_(computer_science)]`_`f`!: Private `F33f`_`[Table`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Table_(database)]`_`f PT; `F33f`_`[quasi-identifier`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Quasi-identifier]`_`f QI = ( `*A`*1, ..., `*A`*n ), `*k`*-anonymity constraint `*k`*; domain generalization hierarchies DGHAi, where `*i`* = 1,...,`*n`* with accompanying `F33f`_`[functions`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Function_(mathematics)]`_`f `*f`*Ai, and loss, which is a limit on the percentage of `F33f`_`[tuples`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Tuple]`_`f that can be suppressed. PT[id] is the set of unique identifiers or keys for each tuple.
`!`F33f`_`[Output`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Output_(computing)]`_`f`!: MGT a generalization of PT[QI] that enforces `*k`*-anonymity
`!Assumes`!: | PT | ≤ `*k`*, and loss * | PT | = `*k`*
`!algorithm Datafly`!:
// Construct a frequency `F33f`_`[list`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=List_(abstract_data_type)]`_`f containing unique `F33f`_`[sequences`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Sequence]`_`f of values across the quasi-identifier in PT,
// along with the number of occurrences of each sequence.
1. let freq be an expandable and collapsible `F33f`_`[vector`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Vector_(mathematics_and_physics)]`_`f with no elements initially. Each element is of the form ( QI, frequency, SID ), where SID = { `*idi`* : ∃ `*t`*[`*id`*] ∈ [`*id`*] ⇒ `*t`*[`*id`*] = `*id`*i }; and, frequency = |SID|. Therefore, freq is also accessible as a table over (QI, frequency, SID).
2. let pos ← ← {\\displaystyle \\gets } 0, total ← ← {\\displaystyle \\gets } 0
3. while total ≠ |PT| do
3.1 freq[pos] ← ← {\\displaystyle \\gets } ( `*t`*[QI], occurs, SID ) where `*t`*[QI] ∈ [QI], ( `*t`*[ QI ],__, ___ ) ∉ {\\displaystyle \\not \\in } freq; occurs = |PT| - |PT[QI] – {`*t`*[QI]}|; and, SID = { `*id`*i : ∃ `*t`*[`*id`*] ← ← {\\displaystyle \\gets } PT[id] ⇒ `*t`*[`*id`*] = `*id`*i }
3.2 pos ← ← {\\displaystyle \\gets } pos + 1, total ← ← {\\displaystyle \\gets } total + occurs
// Make a solution by generalizing the attribute with the most number of distinct values
// and suppressing no more than the allowed number of tuples.
4. let belowk ← ← {\\displaystyle \\gets } 0
5. for pos ← ← {\\displaystyle \\gets } 1 to |freq| do
5.1 ( __, count ) ← ← {\\displaystyle \\gets } freq[pos]
5.2 if count < `*k`* then do
5.2.1 belowk ← ← {\\displaystyle \\gets } belowk + count
6. if belowk > `*k`* then do: // Note. loss * |PT| = `*k`*.
6.1 freq ← ← {\\displaystyle \\gets } generalize(freq)
6.2 go to step 4
7. else do
// assert: the number of tuples to suppress in freq is ≤ loss * |PT|
7.1 freq ← ← {\\displaystyle \\gets } suppress(freq, belowk )
7.2 MGT ← ← {\\displaystyle \\gets } reconstruct(freq)
8. return MGT.
>>References
`:cite-note-1`!1.`! `F0af`_`[↑`#cite-ref-1]`_`f `:citereflatanya-sweeney`aLatanya Sweeney. "Datafly: a system for providing anonymity in medical data". Retrieved 19 January 2014.
`:cite-note-2`!2.`! `F0af`_`[↑`#cite-ref-2]`_`f L. Sweeney, Datafly: a system for providing anonymity in medical data. Database Security, XI: Status and Prospects, T. Lin and S. Qian (eds), Elsevier Science, Amsterdam, 1998.[1]
`:cite-note-3`!3.`! `F0af`_`[↑`#cite-ref-3]`_`f `:citerefxiong`a`F33f`_`[Xiong, Li`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Li_Xiong_(computer_scientist)]`_`f. "Data Anonymization - Generalization Algorithms" (PDF). Retrieved 19 January 2014.
`:cite-note-4`!4.`! `F0af`_`[↑`#cite-ref-4]`_`f `:citereflatanya-sweeney2001`aLatanya Sweeney (2001). `*Computational Disclosure Control A Primer on Data Privacy Protection`* (Thesis). MIT. p. 113. `F33f`_`[hdl`:/page/wikibook/entry.mu`zim=wikipedia_en_all_nopic_2025-08.zim|entry_path=Hdl_(identifier)]`_`f:1721.1/8589.
>>External links
• Details of the Datafly algorithm
`c`F0af`_`[↑ Back to top`#top]`_`f`a