  We introduce a new privacy model relying on bistochastic matrices, that is,
matrices whose components are nonnegative and sum to 1 both row-wise and
column-wise. This class of matrices is used to both define privacy guarantees
and a tool to apply protection on a data set. The bistochasticity assumption
happens to connect several fields of the privacy literature, including the two
most popular models, k-anonymity and differential privacy. Moreover, it
establishes a bridge with information theory, which simplifies the thorny issue
of evaluating the utility of a protected data set. Bistochastic privacy also
clarifies the trade-off between protection and utility by using bits, which can
be viewed as a natural currency to comprehend and operationalize this
trade-off, in the same way than bits are used in information theory to capture
uncertainty. A discussion on the suitable parameterization of bistochastic
matrices to achieve the privacy guarantees of this new model is also provided.
