A method for assessing risk of disclosure in census microdata and tabular data

The area of con dentiality in personal databases is one which is currently of considerable interest. This paper concentrates on current research relating to measuring the risk of disclosure of information about individuals in census data, which the authors believe is directly applicable to other data sources, such as employer-employee databases. Various methods have been used in the past by census o ces in different countries to ensure that requirements of con dentiality are maintained. These include both legal safeguards | typically the user of census data has to sign a binding agreement that they will not misuse the data | and the use of various mechanisms to anonymise and modify data prior to release. The most common methods used are data aggregation, data perturbation and data suppression. There has been little quantitative research to investigate the extent to which any of these methods achieve their stated aim or the extent to which they change the data. The measurement of con dentiality risks is crucial to the comparison of di erent protection methods. Quantitative measures of risk of disclosure would allow researchers to comment critically on the various protection methods associated with current practice, and based on those assessments to give advice about the degree to which data should be modi ed in order to ensure con dentiality. This paper describes research carried out using a new method developed to assess the risk of disclosure in both microdata and tabular data. The work is related to the design of output areas for the reporting of census results. This requires a measure of risk which can be assessed for speci c contexts (such as local areas) rather than for an entire dataset. This localisation of risk assessment allows datasets to be produced in which there is an e cient balance between security and utility of the data. Where risk of disclosure is found to be unacceptable, a proposed area can be rejected, and by a process of redesign and reassessment the area can be modi ed until risk has been reduced to an acceptable level, however where the risk of disclosure is found to be low, the proposed area can be accepted. The alternative | of assessing risk for an entire dataset globally | will generally lead to a situation where areas of high risk are protected at the