Anco Hundepool, Statistics Netherlands, The Netherlands. Josep Domingo-Ferrer, Universitat Rovira i Virgili, Spain. Luisa Franconi, Head of Unit on Statistical Disclosure Control Methods, ISTAT, Italy. Sarah Giessing, Federal Statistical Office of Germany, Germany. Keith Spicer, Office for National Statistics, Portsmouth, UK. Eric Schulte Nordholt, Senior researcher and project leader at Statistics, The Netherlands. Peter-Paul De Wolf, Methodologist at National Institute of Statistics, The Netherlands.

Select Guide Rating

• Preface xiAcknowledgements xv1 Introduction 11.1 Concepts and definitions 21.1.1 Disclosure 21.1.2 Statistical disclosure control 31.1.3 Tabular data 31.1.4 Microdata 31.1.5 Risk and utility 41.2 An approach to Statistical Disclosure Control 71.2.1 Why is confidentiality protection needed? 71.2.2 What are the key characteristics and uses of the data? 81.2.3 What disclosure risks need to be protected against? 81.2.4 Disclosure control methods 81.2.5 Implementation 91.3 The chapters of the handbook 92 Ethics, principles, guidelines and regulations – a general background 102.1 Introduction 102.2 Ethical codes and the new ISI code 112.2.1 ISI Declaration on Professional Ethics 112.2.2 New ISI Declaration on Professional Ethics 122.2.3 European Statistics Code of Practice 152.3 UNECE principles and guidelines 162.3.1 UNECE Principles and Guidelines on Confidentiality Aspects of Data Integration 182.3.2 Future activities on the UNECE principles and guidelines 192.4 Laws 192.4.1 Committee on Statistical Confidentiality 202.4.2 European Statistical System Committee 203 Microdata 233.1 Introduction 233.2 Microdata concepts 243.2.1 Stage 1: Assess need for confidentiality protection 243.2.2 Stage 2: Key characteristics and use of microdata 273.2.3 Stage 3: Disclosure risk 303.2.4 Stage 4: Disclosure control methods 323.2.5 Stage 5: Implementation 343.3 Definitions of disclosure 363.3.1 Definitions of disclosure scenarios 373.4 Definitions of disclosure risk 383.4.1 Disclosure risk for categorical quasi-identifiers 393.4.2 Notation and assumptions 403.4.3 Disclosure risk for continuous quasi-identifiers 413.5 Estimating re-identification risk 433.5.1 Individual risk based on the sample: Threshold rule 443.5.2 Estimating individual risk using sampling weights 443.5.3 Estimating individual risk by Poisson model 473.5.4 Further models that borrow information from other sources 483.5.5 Estimating per record risk via heuristics 493.5.6 Assessing risk via record linkage 503.6 Non-perturbative microdata masking 513.6.1 Sampling 513.6.2 Global recoding 523.6.3 Top and bottom coding 533.6.4 Local suppression 533.7 Perturbative microdata masking 533.7.1 Additive noise masking 543.7.2 Multiplicative noise masking 573.7.3 Microaggregation 603.7.4 Data swapping and rank swapping 723.7.5 Data shuffling 733.7.6 Rounding 733.7.7 Re-sampling 743.7.8 Pram 743.7.9 Massc 783.8 Synthetic and hybrid data 783.8.1 Fully synthetic data 793.8.2 Partially synthetic data 843.8.3 Hybrid data 863.8.4 Pros and cons of synthetic and hybrid data 983.9 Information loss in microdata 1003.9.1 Information loss measures for continuous data 1013.9.2 Information loss measures for categorical data 1083.10 Release of multiple files from the same microdata set 1103.11 Software 1113.11.1 μ-argus 1113.11.2 sdcMicro 1133.11.3 IVEware 1153.12 Case studies 1163.12.1 Microdata files at Statistics Netherlands 1163.12.2 The European Labour Force Survey microdata for research purposes 1183.12.3 The European Structure of Earnings Survey microdata for research purposes 1213.12.4 NHIS-linked mortality data public use file, USA 1283.12.5 Other real case instances 1304 Magnitude tabular data 1314.1 Introduction 1314.1.1 Magnitude tabular data: Basic terminology 1314.1.2 Complex tabular data structures: Hierarchical and linked tables 1324.1.3 Risk concepts 1344.1.4 Protection concepts 1374.1.5 Information loss concepts 1374.1.6 Implementation: Software, guidelines and case study 1384.2 Disclosure risk assessment I: Primary sensitive cells 1384.2.1 Intruder scenarios 1384.2.2 Sensitivity rules 1404.3 Disclosure risk assessment II: Secondary risk assessment 1524.3.1 Feasibility interval 1524.3.2 Protection level 1544.3.3 Singleton and multi cell disclosure 1554.3.4 Risk models for hierarchical and linked tables 1554.4 Non-perturbative protection methods 1574.4.1 Global recoding 1574.4.2 The concept of cell suppression 1574.4.3 Algorithms for secondary cell suppression 1584.4.4 Secondary cell suppression in hierarchical and linked tables 1614.5 Perturbative protection methods 1634.5.1 A pre-tabular method: Multiplicative noise 1654.5.2 A post-tabular method: Controlled tabular adjustment 1654.6 Information loss measures for tabular data 1664.6.1 Cell costs for cell suppression 1664.6.2 Cell costs for CTA 1674.6.3 Information loss measures to evaluate the outcome of table protection 1674.7 Software for tabular data protection 1684.7.1 Empirical comparison of cell suppression algorithms 1694.8 Guidelines: Setting up an efficient table model systematically 1734.8.1 Defining spanning variables 1744.8.2 Response variables and mapping rules 1754.9 Case studies 1784.9.1 Response variables and mapping rules of the case study 1784.9.2 Spanning variables of the case study 1794.9.3 Analysing the tables of the case study 1794.9.4 Software issues of the case study 1815 Frequency tables 1835.1 Introduction 1835.2 Disclosure risks 1845.2.1 Individual attribute disclosure 1855.2.2 Group attribute disclosure 1865.2.3 Disclosure by differencing 1875.2.4 Perception of disclosure risk 1905.3 Methods 1915.3.1 Pre-tabular 1915.3.2 Table re-design 1925.3.3 Post-tabular 1935.4 Post-tabular methods 1935.4.1 Cell suppression 1935.4.2 ABS cell perturbation 1935.4.3 Rounding 1945.5 Information loss 1995.6 Software 2015.6.1 Introduction 2015.6.2 Optimal, first feasible and RAPID solutions 2025.6.3 Protection provided by controlled rounding 2035.7 Case studies 2045.7.1 UK Census 2045.7.2 Australian and New Zealand Censuses 2056 Data access issues 2086.1 Introduction 2086.2 Research data centres 2096.3 Remote execution 2096.4 Remote access 2106.5 Licensing 2116.6 Guidelines on output checking 2116.6.1 Introduction 2116.6.2 General approach 2126.6.3 Rules for output checking 2156.6.4 Organisational/procedural aspects of output checking 2246.6.5 Researcher training 2336.7 Additional issues concerning data access 2366.7.1 Examples of disclaimers 2366.7.2 Output description 2366.8 Case studies 2376.8.1 The US Census Bureau Microdata Analysis System 2376.8.2 Remote access at Statistics Netherlands 239Glossary 243References 261Author index 279Subject index 282

Anco Hundepool, Statistics Netherlands, The Netherlands. Josep Domingo-Ferrer, Universitat Rovira i Virgili, Spain. Luisa Franconi, Head of Unit on Statistical Disclosure Control Methods, ISTAT, Italy. Sarah Giessing, Federal Statistical Office of Germany, Germany. Keith Spicer, Office for National Statistics, Portsmouth, UK. Eric Schulte Nordholt, Senior researcher and project leader at Statistics, The Netherlands. Peter-Paul De Wolf, Methodologist at National Institute of Statistics, The Netherlands.

Select Guide Rating

• Preface xiAcknowledgements xv1 Introduction 11.1 Concepts and definitions 21.1.1 Disclosure 21.1.2 Statistical disclosure control 31.1.3 Tabular data 31.1.4 Microdata 31.1.5 Risk and utility 41.2 An approach to Statistical Disclosure Control 71.2.1 Why is confidentiality protection needed? 71.2.2 What are the key characteristics and uses of the data? 81.2.3 What disclosure risks need to be protected against? 81.2.4 Disclosure control methods 81.2.5 Implementation 91.3 The chapters of the handbook 92 Ethics, principles, guidelines and regulations – a general background 102.1 Introduction 102.2 Ethical codes and the new ISI code 112.2.1 ISI Declaration on Professional Ethics 112.2.2 New ISI Declaration on Professional Ethics 122.2.3 European Statistics Code of Practice 152.3 UNECE principles and guidelines 162.3.1 UNECE Principles and Guidelines on Confidentiality Aspects of Data Integration 182.3.2 Future activities on the UNECE principles and guidelines 192.4 Laws 192.4.1 Committee on Statistical Confidentiality 202.4.2 European Statistical System Committee 203 Microdata 233.1 Introduction 233.2 Microdata concepts 243.2.1 Stage 1: Assess need for confidentiality protection 243.2.2 Stage 2: Key characteristics and use of microdata 273.2.3 Stage 3: Disclosure risk 303.2.4 Stage 4: Disclosure control methods 323.2.5 Stage 5: Implementation 343.3 Definitions of disclosure 363.3.1 Definitions of disclosure scenarios 373.4 Definitions of disclosure risk 383.4.1 Disclosure risk for categorical quasi-identifiers 393.4.2 Notation and assumptions 403.4.3 Disclosure risk for continuous quasi-identifiers 413.5 Estimating re-identification risk 433.5.1 Individual risk based on the sample: Threshold rule 443.5.2 Estimating individual risk using sampling weights 443.5.3 Estimating individual risk by Poisson model 473.5.4 Further models that borrow information from other sources 483.5.5 Estimating per record risk via heuristics 493.5.6 Assessing risk via record linkage 503.6 Non-perturbative microdata masking 513.6.1 Sampling 513.6.2 Global recoding 523.6.3 Top and bottom coding 533.6.4 Local suppression 533.7 Perturbative microdata masking 533.7.1 Additive noise masking 543.7.2 Multiplicative noise masking 573.7.3 Microaggregation 603.7.4 Data swapping and rank swapping 723.7.5 Data shuffling 733.7.6 Rounding 733.7.7 Re-sampling 743.7.8 Pram 743.7.9 Massc 783.8 Synthetic and hybrid data 783.8.1 Fully synthetic data 793.8.2 Partially synthetic data 843.8.3 Hybrid data 863.8.4 Pros and cons of synthetic and hybrid data 983.9 Information loss in microdata 1003.9.1 Information loss measures for continuous data 1013.9.2 Information loss measures for categorical data 1083.10 Release of multiple files from the same microdata set 1103.11 Software 1113.11.1 μ-argus 1113.11.2 sdcMicro 1133.11.3 IVEware 1153.12 Case studies 1163.12.1 Microdata files at Statistics Netherlands 1163.12.2 The European Labour Force Survey microdata for research purposes 1183.12.3 The European Structure of Earnings Survey microdata for research purposes 1213.12.4 NHIS-linked mortality data public use file, USA 1283.12.5 Other real case instances 1304 Magnitude tabular data 1314.1 Introduction 1314.1.1 Magnitude tabular data: Basic terminology 1314.1.2 Complex tabular data structures: Hierarchical and linked tables 1324.1.3 Risk concepts 1344.1.4 Protection concepts 1374.1.5 Information loss concepts 1374.1.6 Implementation: Software, guidelines and case study 1384.2 Disclosure risk assessment I: Primary sensitive cells 1384.2.1 Intruder scenarios 1384.2.2 Sensitivity rules 1404.3 Disclosure risk assessment II: Secondary risk assessment 1524.3.1 Feasibility interval 1524.3.2 Protection level 1544.3.3 Singleton and multi cell disclosure 1554.3.4 Risk models for hierarchical and linked tables 1554.4 Non-perturbative protection methods 1574.4.1 Global recoding 1574.4.2 The concept of cell suppression 1574.4.3 Algorithms for secondary cell suppression 1584.4.4 Secondary cell suppression in hierarchical and linked tables 1614.5 Perturbative protection methods 1634.5.1 A pre-tabular method: Multiplicative noise 1654.5.2 A post-tabular method: Controlled tabular adjustment 1654.6 Information loss measures for tabular data 1664.6.1 Cell costs for cell suppression 1664.6.2 Cell costs for CTA 1674.6.3 Information loss measures to evaluate the outcome of table protection 1674.7 Software for tabular data protection 1684.7.1 Empirical comparison of cell suppression algorithms 1694.8 Guidelines: Setting up an efficient table model systematically 1734.8.1 Defining spanning variables 1744.8.2 Response variables and mapping rules 1754.9 Case studies 1784.9.1 Response variables and mapping rules of the case study 1784.9.2 Spanning variables of the case study 1794.9.3 Analysing the tables of the case study 1794.9.4 Software issues of the case study 1815 Frequency tables 1835.1 Introduction 1835.2 Disclosure risks 1845.2.1 Individual attribute disclosure 1855.2.2 Group attribute disclosure 1865.2.3 Disclosure by differencing 1875.2.4 Perception of disclosure risk 1905.3 Methods 1915.3.1 Pre-tabular 1915.3.2 Table re-design 1925.3.3 Post-tabular 1935.4 Post-tabular methods 1935.4.1 Cell suppression 1935.4.2 ABS cell perturbation 1935.4.3 Rounding 1945.5 Information loss 1995.6 Software 2015.6.1 Introduction 2015.6.2 Optimal, first feasible and RAPID solutions 2025.6.3 Protection provided by controlled rounding 2035.7 Case studies 2045.7.1 UK Census 2045.7.2 Australian and New Zealand Censuses 2056 Data access issues 2086.1 Introduction 2086.2 Research data centres 2096.3 Remote execution 2096.4 Remote access 2106.5 Licensing 2116.6 Guidelines on output checking 2116.6.1 Introduction 2116.6.2 General approach 2126.6.3 Rules for output checking 2156.6.4 Organisational/procedural aspects of output checking 2246.6.5 Researcher training 2336.7 Additional issues concerning data access 2366.7.1 Examples of disclaimers 2366.7.2 Output description 2366.8 Case studies 2376.8.1 The US Census Bureau Microdata Analysis System 2376.8.2 Remote access at Statistics Netherlands 239Glossary 243References 261Author index 279Subject index 282

Anco Hundepool, Statistics Netherlands, The Netherlands. Josep Domingo-Ferrer, Universitat Rovira i Virgili, Spain. Luisa Franconi, Head of Unit on Statistical Disclosure Control Methods, ISTAT, Italy. Sarah Giessing, Federal Statistical Office of Germany, Germany. Keith Spicer, Office for National Statistics, Portsmouth, UK. Eric Schulte Nordholt, Senior researcher and project leader at Statistics, The Netherlands. Peter-Paul De Wolf, Methodologist at National Institute of Statistics, The Netherlands.

Select Guide Rating

• Preface xiAcknowledgements xv1 Introduction 11.1 Concepts and definitions 21.1.1 Disclosure 21.1.2 Statistical disclosure control 31.1.3 Tabular data 31.1.4 Microdata 31.1.5 Risk and utility 41.2 An approach to Statistical Disclosure Control 71.2.1 Why is confidentiality protection needed? 71.2.2 What are the key characteristics and uses of the data? 81.2.3 What disclosure risks need to be protected against? 81.2.4 Disclosure control methods 81.2.5 Implementation 91.3 The chapters of the handbook 92 Ethics, principles, guidelines and regulations – a general background 102.1 Introduction 102.2 Ethical codes and the new ISI code 112.2.1 ISI Declaration on Professional Ethics 112.2.2 New ISI Declaration on Professional Ethics 122.2.3 European Statistics Code of Practice 152.3 UNECE principles and guidelines 162.3.1 UNECE Principles and Guidelines on Confidentiality Aspects of Data Integration 182.3.2 Future activities on the UNECE principles and guidelines 192.4 Laws 192.4.1 Committee on Statistical Confidentiality 202.4.2 European Statistical System Committee 203 Microdata 233.1 Introduction 233.2 Microdata concepts 243.2.1 Stage 1: Assess need for confidentiality protection 243.2.2 Stage 2: Key characteristics and use of microdata 273.2.3 Stage 3: Disclosure risk 303.2.4 Stage 4: Disclosure control methods 323.2.5 Stage 5: Implementation 343.3 Definitions of disclosure 363.3.1 Definitions of disclosure scenarios 373.4 Definitions of disclosure risk 383.4.1 Disclosure risk for categorical quasi-identifiers 393.4.2 Notation and assumptions 403.4.3 Disclosure risk for continuous quasi-identifiers 413.5 Estimating re-identification risk 433.5.1 Individual risk based on the sample: Threshold rule 443.5.2 Estimating individual risk using sampling weights 443.5.3 Estimating individual risk by Poisson model 473.5.4 Further models that borrow information from other sources 483.5.5 Estimating per record risk via heuristics 493.5.6 Assessing risk via record linkage 503.6 Non-perturbative microdata masking 513.6.1 Sampling 513.6.2 Global recoding 523.6.3 Top and bottom coding 533.6.4 Local suppression 533.7 Perturbative microdata masking 533.7.1 Additive noise masking 543.7.2 Multiplicative noise masking 573.7.3 Microaggregation 603.7.4 Data swapping and rank swapping 723.7.5 Data shuffling 733.7.6 Rounding 733.7.7 Re-sampling 743.7.8 Pram 743.7.9 Massc 783.8 Synthetic and hybrid data 783.8.1 Fully synthetic data 793.8.2 Partially synthetic data 843.8.3 Hybrid data 863.8.4 Pros and cons of synthetic and hybrid data 983.9 Information loss in microdata 1003.9.1 Information loss measures for continuous data 1013.9.2 Information loss measures for categorical data 1083.10 Release of multiple files from the same microdata set 1103.11 Software 1113.11.1 μ-argus 1113.11.2 sdcMicro 1133.11.3 IVEware 1153.12 Case studies 1163.12.1 Microdata files at Statistics Netherlands 1163.12.2 The European Labour Force Survey microdata for research purposes 1183.12.3 The European Structure of Earnings Survey microdata for research purposes 1213.12.4 NHIS-linked mortality data public use file, USA 1283.12.5 Other real case instances 1304 Magnitude tabular data 1314.1 Introduction 1314.1.1 Magnitude tabular data: Basic terminology 1314.1.2 Complex tabular data structures: Hierarchical and linked tables 1324.1.3 Risk concepts 1344.1.4 Protection concepts 1374.1.5 Information loss concepts 1374.1.6 Implementation: Software, guidelines and case study 1384.2 Disclosure risk assessment I: Primary sensitive cells 1384.2.1 Intruder scenarios 1384.2.2 Sensitivity rules 1404.3 Disclosure risk assessment II: Secondary risk assessment 1524.3.1 Feasibility interval 1524.3.2 Protection level 1544.3.3 Singleton and multi cell disclosure 1554.3.4 Risk models for hierarchical and linked tables 1554.4 Non-perturbative protection methods 1574.4.1 Global recoding 1574.4.2 The concept of cell suppression 1574.4.3 Algorithms for secondary cell suppression 1584.4.4 Secondary cell suppression in hierarchical and linked tables 1614.5 Perturbative protection methods 1634.5.1 A pre-tabular method: Multiplicative noise 1654.5.2 A post-tabular method: Controlled tabular adjustment 1654.6 Information loss measures for tabular data 1664.6.1 Cell costs for cell suppression 1664.6.2 Cell costs for CTA 1674.6.3 Information loss measures to evaluate the outcome of table protection 1674.7 Software for tabular data protection 1684.7.1 Empirical comparison of cell suppression algorithms 1694.8 Guidelines: Setting up an efficient table model systematically 1734.8.1 Defining spanning variables 1744.8.2 Response variables and mapping rules 1754.9 Case studies 1784.9.1 Response variables and mapping rules of the case study 1784.9.2 Spanning variables of the case study 1794.9.3 Analysing the tables of the case study 1794.9.4 Software issues of the case study 1815 Frequency tables 1835.1 Introduction 1835.2 Disclosure risks 1845.2.1 Individual attribute disclosure 1855.2.2 Group attribute disclosure 1865.2.3 Disclosure by differencing 1875.2.4 Perception of disclosure risk 1905.3 Methods 1915.3.1 Pre-tabular 1915.3.2 Table re-design 1925.3.3 Post-tabular 1935.4 Post-tabular methods 1935.4.1 Cell suppression 1935.4.2 ABS cell perturbation 1935.4.3 Rounding 1945.5 Information loss 1995.6 Software 2015.6.1 Introduction 2015.6.2 Optimal, first feasible and RAPID solutions 2025.6.3 Protection provided by controlled rounding 2035.7 Case studies 2045.7.1 UK Census 2045.7.2 Australian and New Zealand Censuses 2056 Data access issues 2086.1 Introduction 2086.2 Research data centres 2096.3 Remote execution 2096.4 Remote access 2106.5 Licensing 2116.6 Guidelines on output checking 2116.6.1 Introduction 2116.6.2 General approach 2126.6.3 Rules for output checking 2156.6.4 Organisational/procedural aspects of output checking 2246.6.5 Researcher training 2336.7 Additional issues concerning data access 2366.7.1 Examples of disclaimers 2366.7.2 Output description 2366.8 Case studies 2376.8.1 The US Census Bureau Microdata Analysis System 2376.8.2 Remote access at Statistics Netherlands 239Glossary 243References 261Author index 279Subject index 282