Statistical Databases

Introduction Statistical databases are databases containing statistical information. Such databases are normally released by national statistical institutes but, on occasion, they can also be released by healthcare authorities (epidemiology) or by private organizations (e.g. consumer surveys). Statistical databases typically come in three formats: • Tabular data, that is, tables with counts or magnitudes, which are the classical output of official statistics; • Queryable databases, that is, on-line databases to which the user can submit statistical queries (sums, averages, etc.); • Microdata, that is, files where each record contains information on an individual (a citizen or a company). The peculiarity of statistical databases is that they should provide useful statistical information, but they should not reveal private information on the individuals they refer to (respondents). Indeed, supplying data to national statistical institutes is compulsory in most 1 countries but, in return, those institutes commit to preserving the privacy of respondents. Inference control in statistical databases, also known as Statistical Disclosure Control (SDC), is a discipline that seeks to protect data in statistical databases so that they can be published without revealing confidential information that can be linked to specific individuals among those to which the data correspond. SDC is applied to protect respondent privacy in areas such as official statistics, health statistics, e-commerce (sharing of consumer data), etc. Since data protection ultimately means data modification, the challenge for SDC is to achieve protection with minimum loss of the accuracy sought by database users. In [1], a distinction is made between SDC and other technologies for database privacy, like privacy-preserving data mining (PPDM) or private information retrieval (PIR): what makes the difference between those technologies is whose privacy they seek. While SDC is aimed at respondent privacy, the primary goal of PPDM is to protect owner privacy when several database owners wish to cooperate in joint analyses across their databases without giving away their original data to each other. On its side, the primary goal of PIR is user privacy, that is, to allow the user of a database to retrieve some information item without the database exactly knowing which item was recovered. The literature on SDC started in the 1970s, with the seminal contribution by Dalenius [2] in the statistical community and the works by Schlörer and Denning [3, 4] in the database community. The 1980s saw moderate activity in this field. An excellent survey of the state of the art …