Multistage Masking Methods for Microdata Protection

Publication of statistical information by national agencies in the form of microdata (i.e., individual records) raises the problem of preventing disclosure of confidential information about particular respondents without significantly damaging the utility of the data being protected. Often, statistical agencies disseminate information only in the form of tables. But, microdata—records which contain information about individuals or establishments—offer far greater flexibility for statistical research, especially of an exploratory nature, than tables. As a result, there has been an increasing demand from users for such data, and agencies would like to be able to comply this demand, provided that confidentiality is not compromised. In particular, there is a well-recognized need to prevent both identity and attribute disclosure. Before releasing microdata, a statistical office deletes from the data direct identifiers, such as names and addresses; however, the risk of identification still exists, for example, by means of linkage of existing databases, available to the users, to the released data. So, in addition, released microdata are typically perturbed, in order to make disclosure more difficult. For such a purpose, a number of Statistical Disclosure Control (SDC) techniques have been developed. Following are the most widely used SDC methods for microdata: • Rankswapping: First, values of variable Vi are ranked in ascending order. Then, each ranked value of Vi is swapped with another ranked value randomly chosen within a restricted range; e.g., the rank of two swapped values cannot differ by more then p percent of the total number of records. • Microaggregation: Records are clustered into small aggregates or groups of size at least k. Rather than publishing an original variable Vi for a given record, the average of the values of Vi over the group to which the record belongs is published. Classical microaggregation,