Statistical Disclosure Risk: Separating Potential and Harm

International Statistical Review

Volumn 80, Issue 3, 2012, Pages 349-368

  Skinner, Chris ^a  

^a LONDON SCHOOL OF ECONOMICS   (United Kingdom)

Author keywords

Confidentiality; Disclosure limitation; Identification; Intruder

Indexed keywords

EID: 84869853377     PISSN: 03067734     EISSN: 17515823     Source Type: Journal    
DOI: 10.1111/j.1751-5823.2012.00194.x     Document Type: Article

References (62)

1. Abowd, J.M., Nissim, K. & Skinner, C. (2009). First issue editorial. J. Privacy Confident ., 1, 1-6.
2. Bethlehem, J.G., Keller, W.J. & Pannekoek, J. (1990). Disclosure control for microdata. J. Amer. Statist. Assoc., 85, 38-45.
3. Blien, U., Wirth, H. & Müller, M. (1992). Disclosure risk for microdata stemming from official statistics. Statist. Neerlandica, 46, 69-82.
4. Brandt, M., Lenz, R. & Rosemann, M. (2008). Anonymisation of panel enterprise microdata: survey of a German project. In Privacy in Statistical Databases, Lecture Notes in Computer Science 5262, Eds. J. Domingo-Ferrer and Y. Saygin, pp. 139-151. Berlin : Springer.
5. Couper, M.P., Singer, E., Conrad, F.G. & Groves, R.M. (2008). Risk of disclosure, perceptions of risk and concerns about privacy and confidentiality as factors in survey participation. J. Official Statist., 24, 255-275.
6. Couper, M.P., Singer, E., Conrad, F.G. & Groves, R.M. (2010). Experimental studies of disclosure risk, disclosure harm, topic sensitivity, and survey participation. J. Official Statist., 26, 287-300.
7. Cox, L.H. (2001). Disclosure risk for tabular economic data. In Confidentiality, Disclosure and Data Access: Theory and Practical Applications for Statistical Agencies, Eds. P. Doyle, J.I. Lane, J.J.M. Theeuwes and L.V. Zayatz, pp. 167-183. Amsterdam : Elsevier.
8. Cox, L.H., Karr, A.F. & Kinney, S.K. (2011). Risk-utility paradigms for statistical disclosure limitation: how to think, but not how to act (with discussion). Int. Statist. Rev., 79, 160-183.
9. Dalenius, T. (1977). Towards a methodology for statistical disclosure control. Statistisk Tidskrift, 5, 429-444.
10. DeGroot, M.H. (1970). Optimal Statistical Decisions New York : Wiley.
11. Dobra, A., Fienberg, S.E. & Trottini, M. (2003). Assessing the risk of disclosure of confidential categorical data. In Bayesian Statistics 7, Proceedings of the Seventh Valencia International Meeting on Bayesian Statistics, Eds. J.M. Bernardo, M.J. Bayarri, J.O. Berger, A.P. Dawid, D. Heckerman, A.F.M. Smith and M. West, pp. 125-144. Oxford: Oxford University Press.
12. Doyle, P., Lane, J.I., Theeuwes, J.J.M. & Zayatz, L.V. (2001). Confidentiality, Disclosure and Data Access: Theory and Practical Applications for Statistical Agencies. Amsterdam : Elsevier.
13. Duncan, G.T., Elliot, M. & Salazar-González, J.-J. (2011). Statistical Confidentiality New York : Springer.
14. Duncan, G.T., Kelly-McNulty, S.A. & Stokes, S.L. (2001). Disclosure risk vs. data utility: the R-U confidentiality map. Technical Report No. 121, National Institute of Statistical Sciences, North Carolina
15. Duncan, G. & Lambert, D. (1986). Disclosure-limited data dissemination (with discussion). J. Amer. Statist. Assoc ., 81, 10-28.
16. Duncan, G. & Lambert, D. (1989). The risk of disclosure for microdata. J. Bus. Econ. Statist., 7, 207-217.
17. Dwork, C., McSherry, F., Nissim, K. & Smith, A. (2006). Calibrating noise to sensitivity in private data analysis. In Proceedings of the 24th Annual International Cryptography Conference-CRYPTO, 528-544. New York : Springer.
18. Elamir, E.A.H. & Skinner, C.J. (2006). Record level measures of disclosure risk for survey microdata. J. Official Statist., 22, 525-539.
19. Elliot, M.J. & Dale, A. (1999). Scenarios of attack: the data intruder's perspective on statistical disclosure risk. Netherlands Official Statist., 14, 6-10.
20. Fellegi, I.P. (1972). On the question of statistical confidentiality. J. Amer. Statist. Assoc., 67, 7-18.
21. Fellegi, I.P. & Sunter, A.B. (1969). A theory for record linkage. J. Amer. Statist. Assoc., 64, 1183-1210.
22. Fienberg, S.E. (2006). Privacy and confidentiality in an e-commerce world: data mining, data warehousing, matching and disclosure limitation. Statist. Sci ., 21, 143-154.
23. Fienberg, S.E. & Makov, U.E. (1998). Confidentiality, uniqueness and disclosure limitation for categorical data. J. Official Statist., 14, 385-397.
24. Fienberg, S.E., Makov, U.E. & Sanil, A.P. (1997). A Bayesian approach to data disclosure: optimal intruder behavior for continuous data. J. Official Statist., 13, 75-89.
25. Frank, O. (1986). Comment on "Disclosure-limited data dissemination" by G. Duncan & D. Lambert. J. Amer. Statist. Assoc., 81, 21-22.
26. French, S. (1988). Decision Theory: An Introduction to the Mathematics of Rationality Chichester : Ellis Horwood.
27. Fuller, W. (1983).Masking procedures for microdata disclosure limitation. J. Official Statist., 9, 383-406.
28. Gotamam, S., Karr, A.F., Reiter, J.P. & Sanil, A.P. (2005a). Data dissemination and disclosure limitation in a world without microdata: a risk-utility framework for remote access analysis servers. Statist. Sci., 20, 163-177.
29. Gotamam, S., Karr, A.F. & Sanil, A.P. (2005b). Data swapping as a decision problem. J. Official Statist., 21, 635-655.
30. Government Statistical Service (2009). National Statistician's Guidance: Confidentiality of Official Statistics. U.K. : Office For National Statistics.
31. Hand, D.J. (2008). Privacy, data discs and realistic risk. Significance, 5, 11-14.
32. Karr, A.F., Kohnen, C.N., Organian, A., Reiter, J.P. & Sanil, A.P. (2006). A framework for evaluating the utility of data altered to protect confidentiality. Amer. Statist., 60, 224-232.
33. Karr, A.F., Lin, X., Sanil, A.P. & Reiter, J.P. (2005). Secure regressions on distributed databases. J. Comput. Graphical Statist., 14, 263-279.
34. Keeney, R.L. & Raiffa, J. (1976). Decisions with Multiple Objectives: Preferences and Value Tradeoffs New York : Wiley.
35. Keller-McNulty, S., Nakhleh, C.W. & Singpurwalla, N.D. (2005). A paradigm for masking (camouflaging) information. Int. Statist. Rev ., 73, 331-349.
36. Lambert, D. (1993). Measures of disclosure risk and harm. J. Official Statist., 9 313-331.
37. Marsh, C., Skinner, C., Arber, S., Penhale, B., Openshaw, S., Hobcraft, J., Lievesley, D. & Walford, N. (1991). The case for samples of anonymized records from the 1991 census. J. Roy. Statist. Soc. Ser. A, 154, 305-340.
38. National Research Council (2005). Expanding Access to Research Data: Reconciling Risks and Opportunities. Panel on Data Access for Research Purposes, Committee on National Statistics Washington DC : The National Academies Press.
39. National Research Council (2007). Putting People on the Map: Protecting Confidentiality with Linked Social-Spatial Data. Panel on Confidentiality Issues Arising from the Integration of Remotely Sensed and Self Identifying Data, Eds. M.P. Guttmann and P.C. Stern Washington DC : The National Academies Press.
40. O'Hara, K., Whitley, E. & Whittall, P. (2011). Avoiding the jigsaw effect: experiences with Ministry of Justice reoffending Data. Technical Report, Electronics and Computer Science, University of Southampton.
41. Paass, G. (1988). Disclosure risk and disclosure avoidance for microdata. J. Bus. Econ. Statist ., 6, 487-500.
42. Paass, G. & Wauschkuhn, U. (1985). Datenzugang, Datenschutz und Anonymisierung-Analysepotential und Identifizierbarkeit von Anonymisierten Individualdaten. Munich : Oldenbourg Verlag.
43. Reiter, J. (2005). Estimating risks of identification disclosure in microdata. J. Amer. Statist. Assoc., 100, 1103-1112.
44. Reiter, J. (2009). Using multiple imputation to integrate and disseminate confidential microdata. Int. Statist. Rev ., 77, 179-195.
45. Shlomo, N. & Skinner, C. (2010). Assessing the protection provided by misclassification-based disclosure limitation methods for survey microdata. Ann. Appl. Statist., 4, 1291-1310.
46. Singer, E. (2004). Principles and practices related to scientific integrity. In Survey Methodology, Eds. R.M. Groves, F.J. Fowler, M.P. Couper, J.M. Lepkowski, E. Singer and R. Tourangeau New York : Wiley.
47. Skinner, C.J. (2007). The probability of identification: applying ideas from forensic science to disclosure risk assessment. J. Roy. Statist. Soc. Ser. A, 170, 195-212.
48. Skinner, C.J. (2008). Assessing disclosure risk for record linkage. In Privacy in Statistical Databases, Lecture Notes in Computer Science, Vol. 5262, Eds. J. Domingo-Ferrer and Y. Saygin, pp. 166-176. Berlin : Springer.
49. Skinner, C.J. & Carter, R.G. (2003). Estimation of a measure of disclosure risk for survey microdata under unequal probability sampling. Surv. Methodol. 29, 177-180.
50. Skinner, C.J. & Elliot, M.J. (2002). A measure of disclosure risk for microdata. J. Roy. Statist. Soc., Ser. B, 64, 855-867.
51. Skinner, C.J. & Holmes, D.J. (1998). Estimating the re-identification risk per record in microdata. J. Official Statist., 14, 361-372.
52. Skinner, C.J. & Shlomo, N. (2008). Assessing disclosure risk in survey microdata using log-linear models. J. Amer. Statist. Assoc., 103, 989-1001.
53. Spruill, N.L. (1982). Measures of confidentiality. Proc. Sect. Surv. Res. Meth., Washington D.C: American Statistical Association, 260-265.
54. Trottini, M. (2001). A decision-theoretic approach to data disclosure problems. Res. Official Statist ., 4, 7-22.
55. Trottini, M. (2003). Decision models for data disclosure limitation. Ph.D. thesis from the Department of Statistics, Carnegie-Mellon University.
56. Trottini, M. & Fienberg, S.C. (2002). Modelling user uncertainty for disclosure risk and data utility. Intern. J. Uncertainty, Fuzziness and Knowledge-Based Systems, 10, 511-527.
57. Vaughan, E.J. (1997). Risk Management. New York : Wiley.
58. Wasserman, L. & Zhou, S. (2010). A statistical framework for differential privacy. J. Amer. Statist. Assoc., 105, 375-389.
59. Willenborg, L. & De Waal, T. (2001). Elements of Statistical Disclosure Control. New York : Springer.
60. Winkler, W.E. (2004). Masking and re-identification methods for public use microdata: overview and research problems. In Privacy in Statistical Databases, Lecture Notes in Computer Science, Vol. 3050. Eds. J. Domingo-Ferrer and V. Torra, pp. 231-246. Berlin : Springer.
61. Woo, M., Reiter, J.P., Organian, A. & Karr, A.F. (2009). Global measures of data utility for microdata masked for disclosure limitation. J. Privacy Confident ., 1, 111-124.
62. Zaslavsky, A.M. & Horton, N.J. (1998). Balancing disclosure risk against the loss of nonpublication. J. Official Statist., 14, 411-419.