Risk-utility paradigms for statistical disclosure limitation: How to think, but not how to act

International Statistical Review

Volumn 79, Issue 2, 2011, Pages 160-183

  Cox, Lawrence H ^a   Karr, Alan F ^a   Kinney, Satkartar K ^a  

^a NATIONAL INSTITUTE OF ENVIRONMENTAL HEALTH SCIENCES   (United States)

Author keywords

Cell suppression; Controlled rounding; Data quality; Data swapping; Data utility; Disclosure risk; Microaggregation; Risk utility paradigm; Statistical disclosure limitation; Survey weights; Tabular data; Transparency

Indexed keywords

EID: 79960972282     PISSN: 03067734     EISSN: 17515823     Source Type: Journal    
DOI: 10.1111/j.1751-5823.2011.00140.x     Document Type: Article

References (61)

1. Abowd, J.M. & Vilhuber, L. (2008). How protective are synthetic data? In Privacy in Statistical Databases, LNCS 5262, Eds. J. Domingo-Ferrer & Y. Saygin, pp. 239-246, New York: Springer-Verlag.
2. Abowd, J.M. & Woodcock, S.D. (2001). Disclosure limitation in longitudinal linked data. In Confidentiality, Disclosure and Data Access: Theory and Practical Applications for Statistical Agencies, Eds. P. Doyle, J.I. Lane, J.J.M. Theeuwes & L.V. Zayatz, pp. 215-278. Amsterdam: Elsevier.
3. Abowd, J.M. & Woodcock, S.D. (2004). Multiply-imputing confidential characteristics and file links in longitudinal linked data. In Privacy in Statistical Databases, Eds. J. Domingo-Ferrer & V. Torra, pp. 290-297. New York: Springer-Verlag.
4. Cox, L.H. (1980). Suppression methodology and statistical disclosure control. J. Amer. Statist. Assoc., 75, 337-385.
5. Cox, L.H. (1981). Linear sensitivity measures in statistical disclosure control. J. Statist. Plann. Inference, 5, 152-164.
6. Cox, L.H. (1987). A constructive procedure for unbiased controlled rounding. J. Amer. Statist. Assoc., 82, 520-524.
7. Cox, L.H. (1995). Network models for complementary cell suppression. J. Amer. Statist. Assoc., 90, 1453-1462.
8. Cox, L.H. (2003). On properties of multi-dimensional statistical tables. J. Statist. Plann. Inference, 17, 251-273.
9. Cox, L.H. (2007). Contingency tables of network type: models, Markov basis and applications. Statist. Sinica, 17, 1371-1393.
10. Cox, L.H. (2008). A data quality and data confidentiality assessment of complementary cell suppression. In Lecture Notes in Computer Science 5262, Eds. J. Domingo-Ferrer & Y. Saygin, pp. 13-23. Heidelberg: Springer-Verlag.
11. Cox, L.H. (2009). Vulnerability of complementary cell suppression to intruder attack. J. Privacy Confident., 2, 235-251.
12. Cox, L.H. & Ernst, L.R. (1982). Controlled rounding. INFOR: Can. J. Operat. Res. Informat. Process., 20, 423-432.
13. Cox, L.H., Kelly, J.P. & Patil, R. (2004). Balancing quality and confidentiality for multivariate tabular data. In Privacy in Statistical Databases, Lecture Notes in Computer Science 3050, Eds. J. Domingo-Ferrer & V. Torra, pp. 87-98. Berlin: Springer-Verlag.
14. Cox, L.H. & Kim, J. J. (2006). Effects of rounding on the quality and confidentiality of statistical data. In Privacy in Statistical Databases 2006, Lecture Notes in Computer Science 4302, Eds. J. Domingo-Ferrer & L. Franconi, pp. 48-56. Heidelberg: Springer-Verlag.
15. Cox, L.H., Orelien, J.G. & Shah, B.V. (2006). A method for preserving statistical distributions subject to controlled tabular adjustment. In Privacy in Statistical Databases 2006, Lecture Notes in Computer Science 4302, Eds. J. Domingo-Ferrer & L. Franconi, pp. 1-11. Heidelberg: Springer-Verlag.
16. Cox, L.H. & Zayatz, L.V. (1995). An agenda for research in statistical disclosure limitation. J. Official Statist., 11(2), 205-220.
17. De Loera, J. & Onn, S. (2004). All rational polytopes are transportation polytopes and all polytopal integer sets are contingency tables. In IPCO 2004, Lecture Notes in Computer Science 3064, Eds. D. Bienstock & G. Nemhauser, pp. 338-351, Berlin: Springer-Verlag.
18. De Waal, A.G. & Willenborg, L.C.R.J. (1997). Statistical disclosure control and sampling weights. J. Official Statist., 13(4), 417-434.
19. Denogean, L.R., Karr, A.F. & Qaqish, B.F. (2007). Model-based utility of doubly random swapping (forthcoming).
20. Diaconis, P. & Sturmfels, B. (1998). Algebraic algorithms for sampling from conditional distributions. Ann. Statist., 26, 363-397.
21. Dobra, A. (2003). Markov bases for decomposable graphical models. Bernoulli, 9, 1-16.
22. Dobra, A., Fienberg, S.E., Karr, A.F. & Sanil, A.P. (2002). Software systems for tabular data releases. Int. J. Uncertainty, Fuzziness Knowledge Based Syst., 10(5), 529-544.
23. Domingo-Ferrer, J. & í González-Nicolás (2010). Hybrid microdata using microaggregation. Informat. Sci., 180(15), 2834-2844.
24. Domingo-Ferrer, J., Martínez-Ballesté, A., Mateo-Sanz, J.M. & Sebé, F. (2006). Efficient multivariate data-oriented microaggregation. VLDB J., 15, 355-369.
25. Domingo-Ferrer, J. & Mateo-Sanz, J.M. (2002). Practical data-oriented microaggregation for statistical disclosure control. IEEE Trans. Knowledge Data Eng., 14(1), 189-201.
26. Dreschler, J. & Reiter, J.P. (2009). Disclosure risk and data utility for partially synthetic data: an empirical study using the German IAB Establishment Survey. J. Official Statist., 25, 589-603.
27. Dwork, C. (2006). Differential privacy. In Automata, Languages and Programming, volume 4052 ofLecture Notes in Computer Science, Eds. M. Bugliesi, B. Preneel, V. Sassone & I. Wegener, pp. 1-12. Berlin: Springer-Verlag.
28. Evans, T., Zayatz, L. & Slanta, D. (1998). Using noise for disclosure limitation of establishment tabular data. J. Official Statist., 14, 537-551.
29. Fellegi, I.P. (1972). On the question of statistical confidentiality. J. Amer. Statist. Assoc., 67, 7-18.
30. Fienberg, S.E. (2009). The relevance or irrelevance of weights in statistical disclosure limitation. J. Privacy Confident., 1(2), 183-195.
31. Fischetti, M. & Salazar-Gonzalez, J.J. (2001). Solving the cell suppression problem on tabular data with linear constraints. Manage. Sci., 47, 1008-1026.
32. Fraser, B. & Wooton, J. (2005). A proposed method for confidentialising tabular output to protect against differencing. In Monographs of Official Statistics: Work Session on Statistical Data Confidentiality, pp. 299-302. Luxembourg: Eurostat.
33. Gelman, A. (2007). Struggles with survey weighting and regression modeling. Statist. Sci., 22(1), 153-164.
34. Gomatam, S., Karr, A.F. & Sanil, A.P. (2005). Data swapping as a decision problem. J. Official Statist., 21(4), 635-656.
35. Holan, S.H., Toth, D., Ferreira, M.A.R. & Karr, A.F. (2010). Bayesian multiscale multiple imputation with implications to data confidentiality. J. Amer. Statist. Assoc., 105, 564-577.
36. Karr, A.F., Kohnen, C.N., Oganian, A., Reiter, J.P. & Sanil, A.P. (2006a). A framework for evaluating the utility of data altered to protect confidentiality. Amer. Statist., 60(3), 224-232.
37. Karr, A.F. & Last, M. (2006). Survey costs: Workshop report and white paper. Technical Report 161, National Institute of Statistical Sciences ..
38. Karr, A.F., Lee, J., Sanil, A.P., Hernandez, J., Karimi, S. & Litwin, K. (2001). Disseminating information but protecting confidentiality. IEEE Comput., 34(2), 36-37.
39. Karr, A.F., Sanil, A.P. & Banks, D.L. (2006b). Data quality: a statistical perspective. Statist. Methodol., 3(2), 137-173.
40. Kelly, J., Golden, B. & Assad, A. (1992). Cell suppression: Disclosure protection for sensitive tabular data. Networks, 22, 397-417.
41. Kinney, S. K., Reiter, J.P., Reznek, A.P., Miranda, J., Jarmin, R.S. & Abowd, J.M. (2010). Toward unrestricted public-use business microdata: The Longitudinal Business Database. Technical Report, National Institute of Statistical Sciences
42. Kuhn, T. (1962). The Structure of Scientific Revolutions. Chicago, IL: University of Chicago Press.
43. Little, R.J.A. (2003). To model or not to model? Competing modes of inference for finite population sampling. Technical Report, University of Michigan School of Public Health .
44. Lu, W.W. & Sitter, R.R. (2008). Disclosure risk and replication-based variance estimation. Statist. Sinica, 18, 1669-1687.
45. Mitra, R. & Reiter, J.P. (2006). Adjusting survey weights when altering identifying design variables via synthetic data. In Privacy in Statistical Databases 2006, volume 4302 ofLecture Notes in Computer Science, Eds. J. Domingo-Ferrer & L. Franconi, pp. 177-188. Berlin/Heidelberg: Springer-Verlag.
46. National Institute of Statistical Sciences (2003). NISS Data Swapping Toolkit User Documentation.
47. National Research Council Committee on National Statistics (2000). Improving access to and confidentiality of research data: report of a workshop.
48. Oganian, A. (2003). Security and Information Loss in Statistical Database Protection. PhD thesis, Universitat Politècnica de Catalunya
49. Oganian, A. & Karr, A.F. (2006). Combinations of SDC methods for microdata protection. In Privacy in Statistical Databases 2006, volume 4302of Lecture Notes in Computer Science, Eds. J. Domingo-Ferrer & L. Franconi, pp. 102-113. Berlin/Heidelberg: Springer-Verlag.
50. Park, I., Dohrmann, S., Montaquila, J., Mohadjer, L. & Curtin, L.R. (2006). Reducing the risk of data disclosure through area masking: limiting biases in variance estimation. In Proceedings of the ASA Section on Physical and Engineering Sciences, pp. 1761-1767. Alexandria, VA
51. Pistone, G., Riccomagno, E. & Wynn, H. (2001). Algebraic statistics: Computational commutative algebra in statistics. In Monographs on Applied Statistics and Probability 89, Eds. F. Bunea, V. Isham, N. Keiding, T.A. Louis, R.L. Smith & H. Tong London: Chapman and Hall.
52. Reiter, J. P. & Mitra, R. (2009). Estimating risks of identification disclosure in partially synthetic data. J. Privacy Confident., 1, 99-110.
53. Schlörer, J. (1980). Disclosure from statistical databases: quantitative aspects of trackers. ACM Trans. Database Syst., 5, 467-492.
54. Templ, M. (2008). Statistical disclosure control for microdata using the r-package sdcmicro. Trans. Data Privacy, 1(2), 67-85.
55. Trottini, M. (2001). A decision-theoretic approach to data disclosure problems. Res. Official Statist., 4, 7-22.
56. Trottini, M. (2003). Decision Models for Data Disclosure Limitation. PhD thesis, Carnegie Mellon University .
57. Willenborg, L.C.R.J. & de Waal, T. (1996). Statistical Disclosure Control in Practice. New York: Springer-Verlag.
58. Willenborg, L.C.R.J. & de Waal, T. (2001). Elements of Statistical Disclosure Control. New York: Springer-Verlag.
59. Woo, M.-J., Reiter, J.P. & Karr, A.F. (2008). Estimation of propensity scores using generalized additive models. Statist. Med., 23, 3806-3816.
60. Woo, M.-J., Reiter, J.P., Oganian, A. & Karr, A.F. (2009). Global measures of data utility for microdata masked for disclosure limitation. J. Privacy Confident., 1(1), 111-124.
61. Zayatz, L.V., Massell, P. & Steel, P. (1999). Disclosure limitation practices and research at the Census Bureau. Netherlands Official Statist., 14, 26-29.