  Location privacy-preserving mechanisms (LPPMs) have been extensively studied
for protecting a user's location at each time point or a sequence of locations
with different timestamps (i.e., a trajectory). We argue that existing LPPMs
are not capable of protecting the sensitive information in user's
spatiotemporal activities, such as "visited hospital in the last week" or
"regularly commuting between Address 1 and Address 2 every morning and
afternoon" (it is easy to infer that Addresses 1 and 2 may be home and office).
We define such privacy as \textit{Spatiotemporal Event Privacy}, which can be
formalized as Boolean expressions between location and time predicates. To
understand how much spatiotemporal event privacy that existing LPPMs can
provide, we first formally define spatiotemporal event privacy by extending the
notion of differential privacy, and then provide a framework for calculating
the spatiotemporal event privacy loss of a given LPPM under attackers who have
knowledge of user's mobility pattern. We also show a case study of utilizing
our framework to convert the state-of-the-art mechanism for location privacy,
i.e., Planner Laplace Mechanism for Geo-indistinguishability, into one
protecting spatiotemporal event privacy. Our experiments on real-life and
synthetic data verified that the proposed method is effective and efficient.

Databases