Formal privacy protection for data products combining individual and employer frames1

Published tabular summaries of linked employer-employee data usually use a job frame (statutory employer linked to a specific employee) but include characteristics of both the individual (employee) and workplace (employer establishment). Formal privacy protection of these characteristics requires defining the sensitivity of the published statistic to variation in a single individual or a single workplace (establishment). We propose a model that simultaneously protects individuals and establishments using parameters that control the conventional differential privacy for individuals and a generalization that provides a similar privacy guarantee for the employment magnitudes associated with an employer establishment. We implement our model using three alternative noise distributions. We present results for cross-sectional employment summaries for combinations of employer industry, geography, and ownership; and employee sex, age, race, ethnicity, and education. The system is illustrated using the LEHD Origin-Destination Employment Statistics (LODES) database displayed in the U.S. Census Bureau’s OnTheMap application.