  Privacy has become a serious concern for modern Information Societies. The
sensitive nature of much of the data that are daily exchanged or released to
untrusted parties requires that responsible organizations undertake appropriate
privacy protection measures. Nowadays, much of these data are texts (e.g.,
emails, messages posted in social media, healthcare outcomes, etc.) that,
because of their unstructured and semantic nature, constitute a challenge for
automatic data protection methods. In fact, textual documents are usually
protected manually, in a process known as document redaction or sanitization.
To do so, human experts identify sensitive terms (i.e., terms that may reveal
identities and/or confidential information) and protect them accordingly (e.g.,
via removal or, preferably, generalization). To relieve experts from this
burdensome task, in a previous work we introduced the theoretical basis of
C-sanitization, an inherently semantic privacy model that provides the basis to
the development of automatic document redaction/sanitization algorithms and
offers clear and a priori privacy guarantees on data protection; even though
its potential benefits C-sanitization still presents some limitations when
applied to practice (mainly regarding flexibility, efficiency and accuracy). In
this paper, we propose a new more flexible model, named (C, g(C))-sanitization,
which enables an intuitive configuration of the trade-off between the desired
level of protection (i.e., controlled information disclosure) and the
preservation of the utility of the protected data (i.e., amount of semantics to
be preserved). Moreover, we also present a set of technical solutions and
algorithms that provide an efficient and scalable implementation of the model
and improve its practical accuracy, as we also illustrate through empirical
experiments.
