T-closeness

Both k-anonymity and l-diversity have a number of limitations. These privacy definitions are neither necessary nor sufficient to prevent attribute disclosure, particularly if the distribution of sensitive attributes in an equivalence class do not match the distribution of sensitive attributes in the whole data set. t-closeness addresses this problem by requiring that the distribution of a sensitive attribute in any equivalence class is close to the distribution of the attribute in the overall dataset.

Related paper

N. Li, T. Li, and S. Venkatasubramanian. t-closeness: Privacy beyond k-anonymity and l-diversity. In IEEE 23rd International Conference on Data Engineering, April 2007. pdf