Data Confidentiality

When releasing data to the public, data disseminators typically are required to protect the confidentiality of survey respondents’ identities and attribute values. Removing direct identifiers such as names and addresses generally is not sufficient to eliminate disclosure risks, so that data must be altered before release to limit the risks of unintended disclosures. When intense data alteration is needed to ensure protection, the quality of the released data can be seriously degraded. This article reviews a disclosure limitation approach called synthetic data, in which values of confidential data are replaced with simulations from statistical models. Theoretical and empirical investigations have shown that synthetic data approaches have the potential to result in higher data quality than other disclosure limitation procedures, particularly when intense data alteration is necessary. The article discusses the main variants of synthetic data approaches, namely full synthesis and partial synthesis. It includes discussions of synthetic data generation and disclosure risk assessment. Many national statistical agencies, survey organizations, and researchers disseminate microdata, i.e., data on individual units, to the public. Wide access to microdata facilitates advances in science and public policy, encourages replication of findings, enables students to train on genuine datasets, and helps citizens to stay informed about their society. Often, however, data disseminators cannot release microdata in their collected form, because doing so would reveal some respondents’ identities or values of sensitive attributes. Data disseminators therefore typically alter the collected data before release. Common strategies include recoding variables, such as releasing ages in five year intervals or geographies at high levels of aggregation; reporting exact values only above or below certain thresholds, for example reporting all ages above 90 as “90 or more;” swapping data values for selected records, e.g., exchange two or more individuals’ demographic data (Dalenius and Reiss, 1982); and, adding noise to numerical data