Statistical Disclosure Control: New Directions and Challenges

Traditionally, statistical agencies generally release outputs in the form of microdata and tabular data. Microdata contain data from social surveys and tabular data contain either frequency counts, such as for census dissemination, or magnitude data typically arising from business surveys, eg. total revenue. For each of these traditional outputs, there has been much research on how to quantify disclosure risk, optimal statistical disclosure control (SDC) methods and how to assess the impact on data utility. For traditional outputs, the two main disclosure risks are identity disclosure where a statistical unit can be identified based on a set of identifying variables and attribute disclosure where new information can be learnt about an individual or a group of individuals. One disclosure risk that is often overlooked in traditional statistical outputs is inferential disclosure. This disclosure risk has to do with learning new attributes with high probability. For example, a regression model with a very high predictive power may cause inferential disclosure. Even if an individual is not in the dataset, there would still be disclosure from this type of disclosure risk. Another example of inferential disclosure is disclosure by differencing when multiple releases are disseminated from one data source. For example, census tables can be differenced or manipulated to reveal individual units. For traditional hard-copy census tables, disclosure by differencing is controlled by having a fixed set of variables and categories which disallow differencing non-nested groups of individuals. In Section 2 of this paper we provide more discussion of inferential disclosure and define differential privacy as developed in the computer science literature for the protection of outputs in on-line query systems. Inferential disclosure is now a key risk that statistical agencies need to consider when developing new online and remote strategies for disseminating statistical outputs. Section 3 describes recent advances in data dissemination with some examples. Section 4 concludes with a discussion.