Statistical Disclosure Control

Preface xi

Acknowledgements xv

1 Introduction 1

1.1 Concepts and definitions 2

1.1.1 Disclosure 2

1.1.2 Statistical disclosure control 3

1.1.3 Tabular data 3

1.1.4 Microdata 3

1.1.5 Risk and utility 4

1.2 An approach to Statistical Disclosure Control 7

1.2.1 Why is confidentiality protection needed? 7

1.2.2 What are the key characteristics and uses of the data? 8

1.2.3 What disclosure risks need to be protected against? 8

1.2.4 Disclosure control methods 8

1.2.5 Implementation 9

1.3 The chapters of the handbook 9

2 Ethics, principles, guidelines and regulations - a general background 10

2.1 Introduction 10

2.2 Ethical codes and the new ISI code 11

2.2.1 ISI Declaration on Professional Ethics 11

2.2.2 New ISI Declaration on Professional Ethics 12

2.2.3 European Statistics Code of Practice 15

2.3 UNECE principles and guidelines 16

2.3.1 UNECE Principles and Guidelines on Confidentiality Aspects of Data Integration 18

2.3.2 Future activities on the UNECE principles and guidelines 19

2.4 Laws 19

2.4.1 Committee on Statistical Confidentiality 20

2.4.2 European Statistical System Committee 20

3 Microdata 23

3.1 Introduction 23

3.2 Microdata concepts 24

3.2.1 Stage 1: Assess need for confidentiality protection 24

3.2.2 Stage 2: Key characteristics and use of microdata 27

3.2.3 Stage 3: Disclosure risk 30

3.2.4 Stage 4: Disclosure control methods 32

3.2.5 Stage 5: Implementation 34

3.3 Definitions of disclosure 36

3.3.1 Definitions of disclosure scenarios 37

3.4 Definitions of disclosure risk 38

3.4.1 Disclosure risk for categorical quasi-identifiers 39

3.4.2 Notation and assumptions 40

3.4.3 Disclosure risk for continuous quasi-identifiers 41

3.5 Estimating re-identification risk 43

3.5.1 Individual risk based on the sample: Threshold rule 44

3.5.2 Estimating individual risk using sampling weights 44

3.5.3 Estimating individual risk by Poisson model 47

3.5.4 Further models that borrow information from other sources 48

3.5.5 Estimating per record risk via heuristics 49

3.5.6 Assessing risk via record linkage 50

3.6 Non-perturbative microdata masking 51

3.6.1 Sampling 51

3.6.2 Global recoding 52

3.6.3 Top and bottom coding 53

3.6.4 Local suppression 53

3.7 Perturbative microdata masking 53

3.7.1 Additive noise masking 54

3.7.2 Multiplicative noise masking 57

3.7.3 Microaggregation 60

3.7.4 Data swapping and rank swapping 72

3.7.5 Data shuffling 73

3.7.6 Rounding 73

3.7.7 Re-sampling 74

3.7.8 Pram 74

3.7.9 Massc 78

3.8 Synthetic and hybrid data 78

3.8.1 Fully synthetic data 79

3.8.2 Partially synthetic data 84

3.8.3 Hybrid data 86

3.8.4 Pros and cons of synthetic and hybrid data 98

3.9 Information loss in microdata 100

3.9.1 Information loss measures for continuous data 101

3.9.2 Information loss measures for categorical data 108

3.10 Release of multiple files from the same microdata set 110

3.11 Software 111

3.11.1 µ-argus 111

3.11.2 sdcMicro 113

3.11.3 IVEware 115

3.12 Case studies 116

3.12.1 Microdata files at Statistics Netherlands 116

3.12.2 The European Labour Force Survey microdata for research purposes 118

3.12.3 The European Structure of Earnings Survey microdata for research purposes 121

3.12.4 NHIS-linked mortality data public use file, USA 128

3.12.5 Other real case instances 130

4 Magnitude tabular data 131

4.1 Introduction 131

4.1.1 Magnitude tabular data: Basic terminology 131

4.1.2 Complex tabular data structures: Hierarchical and linked tables 132

4.1.3 Risk concepts 134

4.1.4 Protection concepts 137

4.1.5 Information loss concepts 137

4.1.6 Implementation: Software, guidelines and case study 138

4.2 Disclosure risk assessment I: Primary sensitive cells 138

4.2.1 Intruder scenarios 138

4.2.2 Sensitivity rules 140

4.3 Disclosure risk assessment II: Secondary risk assessment 152

4.3.1 Feasibility interval 152

4.3.2 Protection level 154

4.3.3 Singleton and multi cell disclosure 155

4.3.4 Risk models for hierarchical and linked tables 155

4.4 Non-perturbative protection methods 157

4.4.1 Global recoding 157

4.4.2 The concept of cell suppression 157

4.4.3 Algorithms for secondary cell suppression 158

4.4.4 Secondary cell suppression in hierarchical and linked tables 161

4.5 Perturbative protection methods 163

4.5.1 A pre-tabular method: Multiplicative noise 165

4.5.2 A post-tabular method: Controlled tabular adjustment 165

4.6 Information loss measures for tabular data 166

4.6.1 Cell costs for cell suppression 166

4.6.2 Cell costs for CTA 167

4.6.3 Information loss measures to evaluate the outcome of table protection 167

4.7 Software for tabular data protection 168

4.7.1 Empirical comparison of cell suppression algorithms 169

4.8 Guidelines: Setting up an efficient table model systematically 173

4.8.1 Defining spanning variables 174

4.8.2 Response variables and mapping rules 175

4.9 Case studies 178

4.9.1 Response variables and mapping rules of the case study 178

4.9.2 Spanning variables of the case study 179

4.9.3 Analysing the tables of the case study 179

4.9.4 Software issues of the case study 181

5 Frequency tables 183

5.1 Introduction 183

5.2 Disclosure risks 184

5.2.1 Individual attribute disclosure 185

5.2.2 Group attribute disclosure 186

5.2.3 Disclosure by differencing 187

5.2.4 Perception of disclosure risk 190

5.3 Methods 191

5.3.1 Pre-tabular 191

5.3.2 Table re-design 192

5.3.3 Post-tabular 193

5.4 Post-tabular methods 193

5.4.1 Cell suppression 193

5.4.2 ABS cell perturbation 193

5.4.3 Rounding 194

5.5 Information loss 199

5.6 Software 201

5.6.1 Introduction 201

5.6.2 Optimal, first feasible and RAPID solutions 202

5.6.3 Protection provided by controlled rounding 203

5.7 Case studies 204

5.7.1 UK Census 204

5.7.2 Australian and New Zealand Censuses 205

6 Data access issues 208

6.1 Introduction 208

6.2 Research data centres 209

6.3 Remote execution 209

6.4 Remote access 210

6.5 Licensing 211

6.6 Guidelines on output checking 211

6.6.1 Introduction 211

6.6.2 General approach 212

6.6.3 Rules for output checking 215

6.6.4 Organisational/procedural aspects of output checking 224

6.6.5 Researcher training 233

6.7 Additional issues concerning data access 236

6.7.1 Examples of disclaimers 236

6.7.2 Output description 236

6.8 Case studies 237

6.8.1 The US Census Bureau Microdata Analysis System 237

6.8.2 Remote access at Statistics Netherlands 239

Glossary 243

References 261

Author index 279

Subject index 282