  With recent advancements in technology, the threats of privacy violations of
individuals' sensitive data are surging. Location data, in particular, have
been shown to carry a substantial amount of sensitive information. A standard
method to mitigate the privacy risks for location data consists in adding noise
to the true values to achieve geo-indistinguishability (geo-ind). However,
geo-ind alone is not sufficient to cover all privacy concerns. In particular,
isolated locations are not sufficiently protected by the state-of-the-art
Laplace mechanism (LAP) for geo-ind. In this paper, we focus on a mechanism
based on the Blahut-Arimoto algorithm (BA) from the rate-distortion theory. We
show that BA, in addition to providing geo-ind, enforces an elastic metric that
mitigates the problem of isolation. Furthermore, BA provides an optimal
trade-off between information leakage and quality of service. We then proceed
to study the utility of BA in terms of the statistics that can be derived from
the reported data, focusing on the inference of the original distribution. To
this purpose, we de-noise the reported data by applying the iterative Bayesian
update (IBU), an instance of the expectation-maximization method. It turns out
that BA and IBU are dual to each other, and as a result, they work well
together, in the sense that the statistical utility of BA is quite good and
better than LAP for high privacy levels. Exploiting these properties of BA and
IBU, we propose an iterative method, PRIVIC, for a privacy-friendly incremental
collection of location data from users by service providers. We illustrate the
soundness and functionality of our method both analytically and with
experiments.
