What privacy forbids

You cannot define privacy as a property of an output. For every such property, some prior defeats it.
You cannot reach privacy with any deterministic transformation, because linkability is identity (a stable pseudonym is still a stable key).
You cannot answer arbitrary aggregates forever without enabling reconstruction.
You cannot have utility on fine-grained slices and a meaningful ε on the same data.
You cannot compose syntactic guarantees across releases.
You cannot bound disclosure about correlated individuals.
You cannot delete from a trained model cheaply.
You cannot have an erasure mechanism that is itself non-disclosive, because the before-and-after difference is a signal.

Escapes and their prices

Escape	Buys	Pays
k-anonymity family	intuitive, no noise, keeps true values	no composition, collapses in high dimensions, the definition never terminates
Differential privacy	composable, independent of the adversary, quantified	noise ∝ sensitivity/ε, budget depletes on read, useless on small slices, ε is unprincipled
Data minimization	protection at zero utility cost per unit	negates the platform's collect-everything premise; no internal forcing function
Deletion vectors / rewrite	real erasure of source rows	table-rewrite and compaction debt, incomplete reach, aggregates and models out of scope
Consent as a data column	actually enforced at read	intersection semantics shrink usable data at every join
Consent as a metadata tag	cheap, no query cost	convention only; not in the narrowest waist
MPC / private set intersection	inputs never shared, no trusted party	orders-of-magnitude overhead; output disclosure not addressed at all
DP-trained synthetic data	one ε payment, unlimited later queries	the tail is destroyed, which is exactly the records that matter for edge cases

Case, resolvedConstructed case · Dr. Adaeze at Hollis Health

A 5-anonymous extract with a named politician in it

A 5-anonymous research extract let a journalist name a politician, a second extract re-identified three more patients, and an erasure request found the patient in 14 tables, caches, backups, CSVs and a trained model. Where it started: Privacy →

The journalist. The extract was k-anonymous, but the journalist had auxiliary data (a news story, postcode, birth year), and the first class in her case was homogeneous in diagnosis. Dr. Adaeze stops using k-anonymity as the main defence for the extract. Aggregates go out through a query interface with differential privacy and a tracked budget. Wei and she set a total ε per dataset per quarter and allocate it to research groups.
The two extracts. The second release broke the first by composition. Now every release is recorded in a ledger. Only bounds compose, so the ledger tracks the ε spent, not the "anonymity" of each table.
Where DP is too costly. For rare-disease studies, small counts would be mostly noise. Those studies run inside a supervised environment on the real data under a data-use agreement, and nothing leaves except reviewed aggregates.
Synthetic data. The vendor demo and the test environment now use DP-trained synthetic visits. The team writes in the README: "do not draw clinical conclusions from this."
The erasure request. Wei builds the reachability list from the lineage graph: 14 tables, caches, backups (delete on restore), the two exported CSV files (found by asking, since lineage does not see them), and the readmission model, which Hollis schedules for retraining without the patient's data. Dr. Adaeze records in writing what could not be guaranteed. She also asks the harder question: did Hollis need to collect the patient's phone in the lab pipeline at all? Two columns get a retention tag and a purpose tag, and one raw event table becomes derived-only.

The privacy part of Wei's table now says: against the authorized analyst, the only controls are minimization, aggregation with DP, and supervised access. Nothing at the access-control layer touches this adversary. Dr. Adaeze's last note: "This list is long because all our controls that stop outsiders assumed the outsider was the problem."