Statistical Disclosure Control

Anco Hundepool, Statistics Netherlands, The Netherlands. Josep Domingo-Ferrer, Universitat Rovira i Virgili, Spain. Luisa Franconi, Head of Unit on Statistical Disclosure Control Methods, ISTAT, Italy. Sarah Giessing, Federal Statistical Office of Germany, Germany. Keith Spicer, Office for National Statistics, Portsmouth, UK. Eric Schulte Nordholt, Senior researcher and project leader at Statistics, The Netherlands. Peter-Paul De Wolf, Methodologist at National Institute of Statistics, The Netherlands.

Preface xi Acknowledgements xv 1 Introduction 1 1.1 Concepts and definitions 2 1.1.1 Disclosure 2 1.1.2 Statistical disclosure control 3 1.1.3 Tabular data 3 1.1.4 Microdata 3 1.1.5 Risk and utility 4 1.2 An approach to Statistical Disclosure Control 7 1.2.1 Why is confidentiality protection needed? 7 1.2.2 What are the key characteristics and uses of the data? 8 1.2.3 What disclosure risks need to be protected against? 8 1.2.4 Disclosure control methods 8 1.2.5 Implementation 9 1.3 The chapters of the handbook 9 2 Ethics, principles, guidelines and regulations a general background 10 2.1 Introduction 10 2.2 Ethical codes and the new ISI code 11 2.2.1 ISI Declaration on Professional Ethics 11 2.2.2 New ISI Declaration on Professional Ethics 12 2.2.3 European Statistics Code of Practice 15 2.3 UNECE principles and guidelines 16 2.3.1 UNECE Principles and Guidelines on Confidentiality Aspects of Data Integration 18 2.3.2 Future activities on the UNECE principles and guidelines 19 2.4 Laws 19 2.4.1 Committee on Statistical Confidentiality 20 2.4.2 European Statistical System Committee 20 3 Microdata 23 3.1 Introduction 23 3.2 Microdata concepts 24 3.2.1 Stage 1: Assess need for confidentiality protection 24 3.2.2 Stage 2: Key characteristics and use of microdata 27 3.2.3 Stage 3: Disclosure risk 30 3.2.4 Stage 4: Disclosure control methods 32 3.2.5 Stage 5: Implementation 34 3.3 Definitions of disclosure 36 3.3.1 Definitions of disclosure scenarios 37 3.4 Definitions of disclosure risk 38 3.4.1 Disclosure risk for categorical quasi-identifiers 39 3.4.2 Notation and assumptions 40 3.4.3 Disclosure risk for continuous quasi-identifiers 41 3.5 Estimating re-identification risk 43 3.5.1 Individual risk based on the sample: Threshold rule 44 3.5.2 Estimating individual risk using sampling weights 44 3.5.3 Estimating individual risk by Poisson model 47 3.5.4 Further models that borrow information from other sources 48 3.5.5 Estimating per record risk via heuristics 49 3.5.6 Assessing risk via record linkage 50 3.6 Non-perturbative microdata masking 51 3.6.1 Sampling 51 3.6.2 Global recoding 52 3.6.3 Top and bottom coding 53 3.6.4 Local suppression 53 3.7 Perturbative microdata masking 53 3.7.1 Additive noise masking 54 3.7.2 Multiplicative noise masking 57 3.7.3 Microaggregation 60 3.7.4 Data swapping and rank swapping 72 3.7.5 Data shuffling 73 3.7.6 Rounding 73 3.7.7 Re-sampling 74 3.7.8 Pram 74 3.7.9 Massc 78 3.8 Synthetic and hybrid data 78 3.8.1 Fully synthetic data 79 3.8.2 Partially synthetic data 84 3.8.3 Hybrid data 86 3.8.4 Pros and cons of synthetic and hybrid data 98 3.9 Information loss in microdata 100 3.9.1 Information loss measures for continuous data 101 3.9.2 Information loss measures for categorical data 108 3.10 Release of multiple files from the same microdata set 110 3.11 Software 111 3.11.1 -argus 111 3.11.2 sdcMicro 113 3.11.3 IVEware 115 3.12 Case studies 116 3.12.1 Microdata files at Statistics Netherlands 116 3.12.2 The European Labour Force Survey microdata for research purposes 118 3.12.3 The European Structure of Earnings Survey microdata for research purposes 121 3.12.4 NHIS-linked mortality data public use file, USA 128 3.12.5 Other real case instances 130 4 Magnitude tabular data 131 4.1 Introduction 131 4.1.1 Magnitude tabular data: Basic terminology 131 4.1.2 Complex tabular data structures: Hierarchical and linked tables 132 4.1.3 Risk concepts 134 4.1.4 Protection concepts 137 4.1.5 Information loss concepts 137 4.1.6 Implementation: Software, guidelines and case study 138 4.2 Disclosure risk assessment I: Primary sensitive cells 138 4.2.1 Intruder scenarios 138 4.2.2 Sensitivity rules 140 4.3 Disclosure risk assessment II: Secondary risk assessment 152 4.3.1 Feasibility interval 152 4.3.2 Protection leve