Privacy-Preserving Smart-City Data Sharing for Urban Environmental Analytics: A k-Anonymity Case Study

Abstract. Urban analytics increasingly depends on combining sensitive municipal administrative records with heterogeneous sensing data, yet such integration is often constrained by privacy, governance, and data-sharing rules. This paper asks whether a municipality can report a monthly district-level ambient particulate-matter exposure proxy for an enrolled kindergarten cohort without sharing raw child-level records. The case study links kindergarten enrolment data in Sofia with citizen-sensed PM_2.5 and PM₁₀ measurements through a three-pipeline workflow: municipality-side privacy processing, air-quality curation, and consumer-side analytics using only a released cohort and public district centroids. Air-quality data alone can describe ambient pollution, but the cohort release is required to define which children, age ranges, kindergartens, and districts are represented in the reporting population. For January 2025, the release contains 3,440 children and satisfies k-anonymity at k = 12 with respect to district, age range, and kindergarten, with no violating equivalence classes. Across k ∈ {5, 8, 12, 16, 20}, retention decreases from 97.5% to 87.3%, and represented districts decrease from 24 to 22. On the overlapping district set, district mean PM_2.5 summaries remain highly stable relative to the k = 5 release, with Spearman ρ ≥ 0.988 for k ≥ 8 and MAE below 0.3 μg/m³. In a geocoding diagnostic, 45.9% of sampled administrative addresses were resolved under the evaluated protocol, motivating centroid linkage as a coverage-versus-precision design choice. The findings are bounded to one city, one reporting month, and a district-scale reporting task.