  Protecting personal data about individuals, such as event traces in process
mining, is an inherently difficult task: an event trace leaks information about
the path in a process model that an individual has triggered. Yet, prior
anonymization methods of event traces like k-anonymity or event log
sanitization struggled to protect against such leakage, in particular against
adversaries with sufficient background knowledge. In this work, we provide a
method that tackles the challenge of summarizing sensitive event traces by
learning the underlying process tree in a privacy-preserving manner. We prove
via the so-called Differential Privacy (DP) property that from the resulting
summaries no useful inference can be drawn about any personal data in an event
trace. On the technical side, we introduce a differentially private
approximation (DPIM) of the Inductive Miner. Experimentally, we compare our
DPIM with the Inductive Miner on 8 real-world event traces by evaluating
well-known metrics: fitness, precision, simplicity, and generalization. The
experiments show that our DPIM not only protects personal data but also
generates faithful process trees that exhibit little utility loss above the
Inductive Miner.
