Why is choosing the value of k described as "a risk management decision, not a purely technical one"?

Because there's no universal correct k — the choice trades privacy against utility and depends on how much re-identification risk you're willing to accept.

There is no universal value of k that works for all datasets:

• Higher k → greater anonymity, but more generalization, less detail, lower data utility.
• Lower k → more detailed, useful data, but higher risk of re-identification.

Because the "right" answer depends on the sensitivity of the data, the harm of disclosure, and the strength of the expected attacker — not on a formula — selecting k is fundamentally a risk-management judgment. Stakeholders must decide how much residual risk is acceptable for the value the data provides.

Tip: If someone asks "what k should we use?", the honest first answer is "what's your threat model and your risk appetite?"