Statistical Disclosure Control

Statistical Disclosure Control

Volumn , Issue , 2012, Pages 1-288

  Hundepool, Anco ^a   Domingo Ferrer, Josep ^b   Franconi, Luisa ^c   Giessing, Sarah ^d   Nordholt, Eric Schulte ^a   Spicer, Keith ^e   de Wolf, Peter Paul ^a  

^a STATISTICS NETHERLANDS   (Netherlands)

^b UNIVERSITAT ROVIRA I VIRGILI   (Spain)

^c Italian National Institute of Statistics   (Italy)

^d Federal Statistical Office   (Germany)

^e OFFICE FOR NATIONAL STATISTICS   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 84949807262     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.1002/9781118348239     Document Type: Book

References (271)

1. Abowd J.M. and Lane J.I. 2004 New approaches to confidentiality protection: Synthetic data, remote access and research data centers. In Privacy in Statistical Databases, PSD 2004 (eds. Domingo-Ferrer J. and Torra V.), vol. 3050 of Lecture Notes in Computer Science, pp. 282-289. Springer, Berlin/Heidelberg.
2. Abowd J.M. and Woodcock S.D. 2001 Disclosure limitation in longitudinal linked tables. In Confidentiality, Disclosure and Data Access: Theory and Practical Applications for Statistical Agencies (eds. Doyle P., Lane J.I., Theeuwes J.J. and Zayatz L.V.), pp. 215-278. North-Holland, Amsterdam.
3. Abowd J.M. and Woodcock S.D. 2004 Multiply-imputing confidential characteristics and file links in longitudinal linked data. In Privacy in Statistical Databases, PSD 2004 (eds. Domingo-Ferrer J. and Torra V.), vol. 3050 of Lecture Notes in Computer Science, pp. 290-297. Springer, Berlin/Heidelberg.
4. Abowd J.M., Stinson M. and Benedetto G. 2006 Final report to the social security administration on the sipp/ssa/irs public use file project. Technical report, U.S. Census Bureau Longitudinal Employer-Household Dynamics Program.
5. Aggarwal C.C. and Yu P.S. 2004 A condensation approach to privacy preserving data mining. In Advances in Database Technology-EDBT 2004 (eds. Bertino E., Christodoulakis S., Plexousakis D., Christophides V., Koubarakis M., Böhm K. and Ferrari E.), vol. 2992 of Lecture Notes in Computer Science, pp. 183-199. Springer, Berlin/Heidelberg.
6. Aggarwal G., Feder T., Kenthapadi K., Motwani R., Panigrahy R., Thomas D. and Zhu A. 2005 Anonymizing tables. In Proceedings of ICDT 2005 (eds. Eiter T. and Libkin L.), vol. 3363 of Lecture Notes in Computer Science, pp. 246-258. Springer, Berlin/Heidelberg.
7. Agrawal D. and Aggarwal C.C. 2001 On the design and quantification of privacy preserving data mining algorithms. Proceedings of the 20th Symposium on Principles of Database Systems. ACM, Santa Barbara CA.
8. An D. and Little R. 2007 Multiple imputation: an alternative to top coding for statistical disclosure control. Journal of the Royal Statistical Society, Series A 170, 923-940.
9. Bacher J., Brand R. and Bender S. 2002 Re-identifying register data by survey data using cluster analysis: an empirical study. International Journal of Uncertainty, Fuzziness and Knowledge Based Systems 10(5), 589-607.
10. Benedetti R. and Franconi L. 1998 Statistical and technological solutions for controlled data dissemination. Pre-proceedings of New Techniques and Technologies for Statistics, vol. 1, pp. 225-232. Eurostat, Luxemburg.
11. Box G.E.P. and Cox D.R. 1964 An analysis of transformations. Journal of Royal Statistical Society, Series B 26(22), 211-252.
12. Brand R. 2002a Microdata protection through noise addition. In Inference Control in Statistical Databases (ed. Domingo-Ferrer J.), vol. 2316 of Lecture Notes in Computer Science, pp. 97-116. Springer, Berlin/Heidelberg.
13. Brand R. 2002b Tests of the applicability of Sullivan's algorithm to synthetic data and real business data in official statistics. Deliverable of European Project IST-2000-25069 CASC, available at http://neon.vb.cbs.nl/casc.
14. Brand R., Domingo-Ferrer J. and Mateo-Sanz J.M. 2002 Reference data sets to test and compare SDC methods for protection of numerical microdata. Deliverable of European Project IST-2000-25069 CASC, available at http://neon.vb.cbs.nl/casc.
15. Brown D. 2004 Different approaches to disclosure control problems associated with geography Work session on Statistical Data Confidentiality, Luxembourg, 7-9 April 2003, pp. 250-262. Monographs in Official Statistics. Eurostat, Luxembourg. Available at http://www.unece.org/fileadmin/DAM/stats/documents/2003/04/confidentiality/wp.14.e.pdf.
16. Burridge J. 2003 Information preserving statistical obfuscation. Statistics and Computing 13, 321-327.
17. Casciano C., Ichim D. and Corallo L. 2011 Sampling as a way to reduce risk and create a Public Use File maintaining weighted totals. Paper presented at the Joint UNECE/Eurostat work session on Statistical Data Confidentiality, Tarragona, 26-28 October 2011. Available at http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2011/04_Italy-Casciano.pdf.
18. Castro J. 2003 User's and programmer's manual of the network flows heuristics package for cell suppression in 1h2d tables. Technical Report DR 2003-07, Department of Statistics and Operations Research, Universitat Politecnica de Catalunya, Barcelona, Spain. Available at http://neon.vb.cbs.nl/casc/deliv/41D6_NF1H2D-Tau-Argus.pdf.
19. Castro J. 2006 Minimum-distance controlled perturbation methods for large-scale tabular data protection. European Journal of Operational Research 171, 39-52.
20. Castro J. 2012 Recent advances in optimization techniques for statistical tabular data protection. European Journal of Operational Research 216, 257-269.
21. Castro J. and Giessing S. 2006a Quality issues of minimum distance controlled tabular adjustment. Paper presented at the European Conference on Quality in Survey Statistics, Cardiff, 24-26 April 2006.
22. Castro J. and Giessing S. 2006b Testing variants of minimum distance controlled tabular adjustment.Work session on Statistical Data Confidentiality, Geneva, 9-11 November 2005, pp. 333-343 Monographs in Official Statistics. Eurostat, Luxembourg.
23. Castro J. and Gonzalez J.A. 2009 A package for l1 controlled tabular adjustment Paper presented at the Joint UNECE/Eurostat work session on Statistical Data Confidentiality, Bilbao, 2-4 December 2009.
24. Cator E., Hensbergen A. and Rozenholc Y. 2005 Statistical disclosure control using PRAM. Proceedings of the 48th European Study Group Mathematics with Industry, pp. 23-30. Delft University Press, Delft, The Netherlands.
25. Chatfield C. and Collins A.J. 1980 Introduction to Multivariate Analysis. Chapman and Hall, London.
26. Chaudhuri A. and Mukerjee R. 1988 Randomized Response, Theory and Techniques. Marcel Dekker Inc., New York.
27. Chen T.T. 1979 Analysis of randomized response as purposively misclassified data. Proceedings of the section on survey research methods, pp. 158-163 American Statistical Association, USA.
28. Cox L.H. 1981 Linear sensitivity measures in statistical disclosure control. Journal of Planning and Inference 5, 153-164.
29. Cox L.H. 2001 Disclosure risk for tabular economic data. In Confidentiality, Disclosure and Data Access: Theory and Practical Applications for Statistical Agencies (eds. Doyle, Lane, Theeuwes and Zayatz), Chapter 8, North-Holland, Amsterdam, Netherlands.
30. Cox L.H. and Dandekar R.H. 2002 Synthetic tabular data-an alternative to complementary cell suppression. Manuscript available from ramesh.dandekar@eia.doe.gov or as http://mysite.verizon.net/vze7w8vk/syn_tab.pdf.
31. Cox L.H., Karr A.F. and Kinney S.K. 2011 Risk-utility paradigms for statistical disclosure limitation: how to think, but not how to act. International Statistical Review 79(2), 160-183.
32. Cox L.H., Kelly J.P. and Patil R. 2004 Balancing quality and confidentiality for multivariate tabular data. Privacy in Statistical Databases, PSD 2004, vol. 3050 of Lecture Notes in Computer Science, pp. 87-98. Springer, Berlin/Heidelberg.
33. Cox L.H., Orelien J.G. and Shah B.V. 2006 A method for preserving statistical distributions subject to controlled tabular adjustment. In Privacy in Statistical Databases, PSD 2006 (eds. Domingo-Ferrer J. and Franconi L.), vol. 4302 of Lecture Notes in Computer Science, pp. 1-11. Springer, Berlin/Heidelberg.
34. CRAN 2011 The Comprehensive R Archive Network. Available at http://cran.r-project.org.
35. Crystal.Ball 2004. Available at http://download.cnet.com/Crystal-Ball-2000-Pro/3000-18483_4-38546.html and http://www.oracle.com/us/products/applications/crystalball.
36. Daalmans J. and deWaal T. 2011 An improved formulation of the disclosure auditing problem for secondary cell suppression. Transactions on Data Privacy 3, 217-251.
37. Dalenius T. 1977 Towards a methodology for statistical disclosure control. Statistisk Tidskrift 5, 429-444.
38. Dalenius T. 1986 Finding a needle in a haystack-or identifying anonymous census records. Journal of Official Statistics 2(3), 329-336.
39. Dalenius T. and Reiss S.P. 1978 Data-swapping: a technique for disclosure control (extended abstract). Proceedings of the ASA Section on Survey Research Methods, pp. 191-194. American Statistical Association, Washington DC.
40. Dandekar R., Cohen M. and Kirkendall N. 2002a Sensitive micro data protection using Latin hypercube sampling technique. In Inference Control in Statistical Databases (ed. Domingo-Ferrer J.), vol. 2316 of Lecture Notes in Computer Science, pp. 245-253. Springer, Berlin/Heidelberg.
41. Dandekar R., Domingo-Ferrer J. and Sebé F. 2002b Lhs-based hybrid microdata vs rank swapping and microaggregation for numeric microdata protection. In Inference Control in Statistical Databases (ed. Domingo-Ferrer J.), vol. 2316 of Lecture Notes in Computer Science, pp. 153-162. Springer, Berlin/Heidelberg.
42. de Waal A.G. and Willenborg L.C.R.J. 1995 Global recodings and local suppressions in microdata sets. Proceedings of Statistics Canada Symposium'95, pp. 121-132. Statistics Canada, Ottawa.
43. de Waal A.G. and Willenborg L.C.R.J. 1999 Information loss through global recoding and local suppression. Netherlands Official Statistics 14, 17-20. Special issue on SDC.
44. de Wolf P.P. 2002 Hitas: a heustic approach to cell suppression in hierarchical tables. In Inference Control in Statistical Databases 2002 (ed. Domingo-Ferrer J.), vol. 2316 of Lecture Notes in Computer Science. Springer, Berlin.
45. deWolf P.P. 2007 Cell suppression in a special class of linked tables.Work session on Statistical Data Confidentiality, Manchester, 17-19 December 2007, pp. 220-226. Methodologies and Working papers. Eurostat, Luxembourg. Available at http://www.unece.org/fileadmin/DAM/stats/documents/2007/12/confidentiality/wp.21.e.pdf.
46. de Wolf P.P. and Giessing S. 2008 How to make the τ-argus modular method applicable to linked tables. In Privacy in Statistical Databases, PSD 2008 (eds. Domingo-Ferrer J. and Saygın Y.), vol. 5262 of Lecture Notes in Computer Science, pp. 227-238. Springer, Berlin/Heidelberg.
47. de Wolf P.P. and Hundepool A. 2010 Three ways to deal with a set of linked sbs tables using τ-argus. InPrivacy in Statistical Databases, PSD2010 (eds. Domingo-Ferrer J. and Magkos E.), vol. 6344 of Lecture Notes in Computer Science, pp. 66-73. Springer, Heidelberg.
48. de Wolf P.P. and van Gelder I. 2004 An empirical evaluation of PRAM. Technical report, Statistics Netherlands. Discussion paper 04012, available at http://neon.vb.cbs.nl/casc.
49. de Wolf P.P., Gouweleeuw J.M., Kooiman P. and Willenborg L.C.R.J. 1998 Reflections on PRAM Statistical Data Protection, Proceedings of the conference, Lisbon, 25-27 March 1998, pp. 337-349. Eurostat, Luxembourg. Available at http://neon.vb.cbs.nl/casc/related/Sdp_98_2.pdf.
50. Defays D. and Nanopoulos P. 1993 Panels of enterprises and confidentiality: the small aggregates method. Proceedings of 92 Symposium on Design and Analysis of Longitudinal Surveys, pp. 195-204. Statistics Canada, Ottawa.
51. Di Consiglio L. and Polettini S. 2006 Improving individual risk estimators. In Privacy in Statistical Databases, PSD 2006 (eds. Domingo-Ferrer J. and Franconi L.), vol. 4302 of Lecture Notes in Computer Science, pp. 241-256. Springer, Berlin/Heidelberg.
52. Di Consiglio L. and Polettini S. 2008 Use of auxiliary information in risk estimation. In Privacy in Statistical Databases, PSD 2008 (eds. Domingo-Ferrer J. and Saygın Y.), vol. 5262 of Lecture Notes in Computer Science, pp. 213-225. Springer, Berlin/Heidelberg.
53. Domingo-Ferrer J. 2011 Risk-utility paradigms for statistical disclosure limitation: how to think, but not how to act-discussion: a science of statistical disclosure limitation? International Statistical Review 79(2), 184-186.
54. Domingo-Ferrer J. and González-Nicolás U. 2010 Hybrid data using microaggregation. Information Sciences 180(15), 2834-2844.
55. Domingo-Ferrer J. and Mateo-Sanz J.M. 1999 On resampling for statistical confidentiality in contingency tables. Computers & Mathematics with Applications 38, 13-32.
56. Domingo-Ferrer J. and Mateo-Sanz J.M. 2002 Practical data-oriented microaggregation for statistical disclosure control. IEEE Transactions on Knowledge and Data Engineering 14(1), 189-201.
57. Domingo-Ferrer J. and Solanas A. 2008 A measure of variance for hierarchical nominal attributes. Information Sciences 178(24), 4644-4655. Erratum available at Information Sciences, 179(20): 3732, 2009.
58. Domingo-Ferrer J. and Torra V. 2001a Disclosure protection methods and information loss for microdata. In Confidentiality, Disclosure and Data Access: Theory and Practical Applications for Statistical Agencies (eds. Doyle P., Lane J.I., Theeuwes J.J.M. and Zayatz L.), pp. 91-110. North-Holland, Amsterdam.
59. Domingo-Ferrer J. and Torra V. 2001b A quantitative comparison of disclosure control methods for microdata. In Confidentiality, Disclosure and Data Access: Theory and Practical Applications for Statistical Agencies (eds. Doyle P., Lane J.I., Theeuwes J.J.M. and Zayatz L.), pp. 111-134. North-Holland, Amsterdam.
60. Domingo-Ferrer J. and Torra V. 2003 Disclosure risk assessment in statistical microdata protection via advanced record linkage. Statistics and Computing 13(4), 343-354.
61. Domingo-Ferrer J. and Torra V. 2005 Ordinal, continuous and heterogenerous k-anonymity through microaggregation. Data Mining and Knowledge Discovery 11(2), 195-212.
62. Domingo-Ferrer J. and Torra V. 2008 A critique of k-anonymity and some of its enhancements. Proceedings of ARES/PSAI 2008, pp. 990-993. IEEE Computer Society, Los Alamitos, CA.
63. Domingo-Ferrer J., Drechsler J. and Polettini S. 2009 Report on synthetic data files. Technical report, Deliverable of Project ESSNET-SDC.
64. Domingo-Ferrer J., Mateo-Sanz J.M. and TorraV. 2001 ComparingSDCmethods for microdata on the basis of information loss and disclosure risk. Pre-proceedings of ETK-NTTS'2001 (vol. 2), pp. 807-826. Eurostat, Luxembourg.
65. Domingo-Ferrer J., Mateo-Sanz J.M., Oganian A. and Torres A. 2002 On the security of microaggregation with individual ranking: analytical attacks. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems 10(5), 477-492.
66. Domingo-Ferrer J., Sebé F. and Castella J. 2004 On the security of noise addition for privacy in statistical databases. In Privacy in Statistical Databases, PSD 2004 (eds. Domingo-Ferrer J. and Torra V.), vol. 3050 of Lecture Notes in Computer Science, pp. 149-161. Springer, Berlin/Heidelberg.
67. Domingo-Ferrer J., Sebé F. and Solanas A. 2008 A polynomial-time approximation to optimal multivariate microaggregation. Computers & Mathematics with Applications 55(4), 714-732.
68. Doyle P., Lane J.I., Theeuwes J.M.M. and Zayatz L. 2001 Confidentiality, Disclosure and Data Access: Theory and Practical Application for Statistical Agencies. Elsevier Science BV, North-Holland, Amsterdam.
69. Drechsler J. and Reiter J. 2008 Accounting for intruder uncertainty due to sampling when estimating identification disclosure risks in partially synthetic data. In Privacy in Statistical Databases, PSD 2008 (eds. Domingo-Ferrer J. and Saygın Y.), vol. 5262 of Lecture Notes in Computer Science, pp. 227-238. Springer, Berlin/Heidelberg.
70. Drechsler J., Bender S. and Rässler S. 2008a Comparing fully and partially synthetic datasets for statistical disclosure control in the German IAB Establishment Panel. Transactions on Data Privacy 1(3), 105-130.
71. Drechsler J., Dundler A., Bender S., Rässler S. and Zwick T. 2008b A new approach for statistical disclosure control in the IAB establishment panel-multiple imputation for a better data access. Advances in Statistical Analysis 92(4), 439-458.
72. Duke-Williams O. and Rees P. 1998 Can census offices publish statistics for more than one small area geography? an analysis of the differencing problem in statistical disclosure. International Journal of Geographical Information Science 12, 579-605.
73. Duncan G. and Lambert D. 1986 Disclosure-limited data dissemination. Journal of the American Statistical Association 81(3), 10-27.
74. Duncan G., Keller-McNulty S. and Stokes S. 2001 Disclosure risk vs. data utility: the r-u confidentiality map. Technical Report LA-UR-01-6428, Los Alamos National Laboratory, Statistical Sciences Group, Los Alamos, New Mexico.
75. Duncan G.T. and Pearson R.W. 1991 Enhancing access to microdata while protecting confidentiality: prospects for the future. Statistical Science 6, 219-239.
76. Duncan G.T., Elliot M. and Salazar-González J.J. 2011 Statistical Confidentiality Principles and Practice Statistics for Social and Behavioral Sciences. Springer, New York, Dordrecht, Heidelberg, London.
77. Dwork C. 2006 Differential privacy Proceedings of 33rd International Colloquium on Automata, Languages and Programming (ICALP), vol. 4052 of Lecture Notes in Computer Science, pp. 1-12. Springer, Berlin.
78. Dwork C. 2011 A firm foundation for private data analysis. Communications of the ACM 54(1), 86-95.
79. Elamir E.A.H. and Skinner C.J. 2006 Record level measures of disclosure risk for survey microdata. Journal of Official Statistics 22(3), 525-539.
80. Elliot M.J. 2000 DIS: a new approach to the measurement of statistical disclosure risk. International Journal of Risk Management 2(4), 39-48.
81. Elliot M.J. and Dale A. 1999 Scenarios of attack: a data intruder's perspective on statistical disclosure risk. Netherlands Official Statistics 14, 6-10.
82. Elliot M.J., Lomax S., Mackey E. and Purdam K. 2010 Data environment analysis and the Key Variable Mapping System. In Privacy in Statistical Databases, PSD 2010 (eds. Domingo-Ferrer J. and Magkos E.), vol. 6344 of Lecture Notes in Computer Science, pp. 138-145. Springer, Berlin/Heidelberg.
83. Elliot M.J., Manning A.M. and Ford R.W. 2002 A computational algorithm for handling the special uniques problem. International Journal of Uncertainty, Fuzziness and Knowledge Based Systems 5(10), 493-509.
84. Elliot M.J., Manning A.M., Mayes K., Gurd J. and Bane M. 2006 SUDA: a program for detecting special uniques. Work session on Statistical Data Confidentiality, Geneva, 9-11 November 2005, pp. 353-362. Monographs in Official Statistics. Eurostat, Luxembourg. Available at http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2005/wp.44.e.pdf.
85. Elliot M.J., Skinner C.J. and Dale A. 1998 Special uniques, random uniques, and sticky populations: some counterintuitive effects of geographical detail on disclosure risk. Research in Official Statistics 1(2), 53-67.
86. ESSnet on Common tools and harmonised methodology for SDC in the ESS 2012 Deliverables. Available at http://neon.vb.cbs.nl/casc/ESSNet2Deliverables.htm.
87. Eurostat 1990 Council regulation 1588/90. Available at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31990R1588:EN:HTML.
88. Eurostat 1997 Council regulation 322/97. Available at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31997R0322:EN:HTML.
89. Eurostat 2002 Commission regulation (ec) no 831/2002 concerning access to confidential data for scientific purposes. Available at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2002:133:0007:0009:EN:PDF.
90. Eurostat 2009 Commission regulation (EC) no 223/2009 on European statistics. Available at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:087:0164:0173:en:PDF.
91. Eurostat 2010 European Union Structure of Earning Survey access to microdata. Available at http://epp.eurostat.ec.europa.eu/portal/page/portal/microdata/ses.
92. Eurostat 2011a European statistics code of practice. Available at http://epp.eurostat.ec.europa.eu/portal/page/portal/quality/documents/KS-32-11-995-EN-C.pdf.
93. Eurostat 2011b European Union Labour Force Survey (EU LFS) access to microdata.Available at http://epp.eurostat.ec.europa.eu/portal/page/portal/microdata/lfs.
94. Eurostat 2011c Quality report of the European Union Labour Force Survey 2009. Available at http://epp.eurostat.ec.europa.eu/cache/ITY_OFFPUB/KS-RA-11-020/EN/KS-RA-11-020-EN.PDF.
95. Evans B.T., Zayatz L. and Slanta J. 1998 Using noise for disclosure limitation for establishment tabular data. Journal of Official Statistics 14, 537-552.
96. Fellegi I.P. and Sunter A.B. 1969 A theory for record linkage. Journal of the American Statistical Association 64(328), 1183-1210.
97. Fienberg S.E. 1994 A radical proposal for the provision of micro-data samples and the preservation of confidentiality. Technical Report 611, Carnegie Mellon University Department of Statistics.
98. Fienberg S.E. and Makov U.E. 1998 Confidentiality, uniqueness and disclosure limitation for categorical data. Journal of Official Statistics 14(4), 385-397.
99. Fienberg S.E. and McIntyre J. 2004 Data swapping: variations on a theme by Dalenius and Reiss. In Privacy in Statistical Databases, PSD 2004 (eds. Domingo-Ferrer J. and Torra V.), vol. 3050 of Lecture Notes in Computer Science, pp. 14-29. Springer, Berlin/Heidelberg.
100. Fienberg S.E., Makov U.E. and Steele R.J. 1998 Disclosure limitation using perturbation and related methods for categorical data. Journal of Official Statistics 14(4), 485-502.
101. Fischetti M. and Salazar-González J.J. 2000 Models and algorithms for optimizing cell suppression problem in tabular data with linear constraints. Journal of the American Statistical Association 95, 916-928.
102. Fischetti M. and Salazar-González J.J. 2003 Partial cell suppression: a new methodology for statistical disclosure control. Statistics and Computing 13, 13-21.
103. Florian A. 1992 An efficient sampling scheme: updated Latin hypercube sampling. Probabilistic Engineering Mechanics 7(2), 123-130.
104. Forbes A., Naylor J., LeaverV., Gare M.,Hawkes T. and Camden M. 2009 Confidentiality plans for the 2011 censuses in the United Kingdom, Australia and New Zealand: a comparison. Paper presented at the Joint UNECE/Eurostat work session on Statistical Data Confidentiality, Bilbao, 2-4 December 2009. Available at http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2009/wp.28.e.pdf.
105. Foschi F. 2011 Risk for high dimensional business microdata. Paper presented at the Joint UNECE/Eurostat work session on Statistical Data Confidentiality, Tarragona, 26-28 October 2011. Available at http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2011/03_Italy-Foschi.pdf.
106. Franconi L. and Ichim D. 2007 Community Innovation Survey: comparable dissemination. Work session on Statistical Data Confidentiality, Manchester, 17-19 December 2007, pp. 11-23. Methodologies and Working papers. Eurostat, Luxembourg. Available at http://www.unece.org/fileadmin/DAM/stats/documents/2007/12/confidentiality/wp.2.e.pdf.
107. Franconi L. and Polettini S. 2004 Individual risk estimation in μ-argus: a review. In Privacy in Statistical Databases, PSD 2004 (eds. Domingo-Ferrer J. and Torra V.), vol. 3050 of Lecture Notes in Computer Science, pp. 262-272. Springer, Berlin/Heidelberg.
108. Franconi L. and Stander J. 2002 A model based method for disclosure limitation of business microdata. Journal of the Royal Statistical Society D-Statistician 51, 1-11.
109. Franconi L., Ichim D. and Corallo L. 2011 Farm Structure Survey: consideration on the release of a European microdata file for research purposes. Joint UNECE/Eurostat work session on Statistical Data Confidentiality, Tarragona, 26-28 October 2011. Available at http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2011/36_Italy.pdf.
110. Fraser B. andWooton J. 2006 A proposed method for confidentialising tabular output to protect against differencingWork session on Statistical Data Confidentiality, Geneva, 9-11 November 2005, pp. 299-302. Monographs in Official Statistics. Eurostat, Luxembourg. Available at http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2005/wp.35.e.pdf.
111. Frend J., Abrahams C., Groom P., Spicer K., Tudor C. and Forbes A. 2011 Statistical disclosure control for communal establishments in theUK2011 census Paper presented at the Joint UNECE/Eurostat work session on Statistical Data Confidentiality, Tarragona, 26-28 October 2011. Available at http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2011/15_UK.pdf.
112. Frolova O., Fillion J.M. and Tambay J.L. 2009 CONFID2: Statistics Canada's new tabular data confidentiality software. SSC Annual Meeting, Proceedings of the Survey Methods Section. Statistics Canada, Ottawa, Canada.
113. Geurts J. 1992 Heuristics for cell suppression in tables. Technical report, Statistics Netherlands.
114. Giessing S. 2004 Survey on methods for tabular protection in Argus. In Privacy in statistical databases, PSD 2004 (eds. Domingo-Ferrer J. and Torra V.), vol. 3050 of Lecture Notes in Computer Science, pp. 1-13. Springer, Berlin/Heidelberg.
115. Giessing S. 2008 Protection of tables with negative values. ESSnet report, Destatis. Available at http://neon.vb.cbs.nl/casc/ESSnet/PosNegReport.pdf.
116. Giessing S. 2009 Techniques for using τ -argus modular on sets of linked tables. Paper presented at the Joint UNECE/Eurostatwork session on Statistical Data Confidentiality, Bilbao, 2-4 December 2009. Available at http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2009/wp.35.e.pdf.
117. Giessing S. 2011 Post-tabular stochastic noise to protect skewed business data. Paper presented at the Joint UNECE/Eurostat work session on Statistical Data Confidentiality, Tarragona, 26-28 October 2011. Available at http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2011/47_Giessing.pdf.
118. Giessing S. and Repsilber D. 2002 Tools and strategies to protect multiple tables with the ghquar cell suppression engine. In Inference Control in Statistical Databases (ed. Domingo-Ferrer J.), vol. 2316 of Lecture Notes in Computer Science. Springer, Berlin/Heidelberg.
119. Giessing S., Dittrich S., Gehrling D., Krüger A., Merz F.J. and Wirtz H. 2006 Bericht der Arbeitsgruppe 'geheimhaltungskonzept des statistischen verbundes, pilotanwendung: Umsatzsteuerstatistik' (in German) Document for the meeting of the 'Ausschuss für Organisation und Umsetzung'.
120. Giessing S., Hundepool A. and Castro J. 2007 Rounding methods for protecting EUaggregates. Work session on Statistical Data Confidentiality, Manchester, 17-19 December 2007, pp. 255-264. Methodologies and Working papers. Eurostat, Luxembourg. Available at http://www.unece.org/fileadmin/DAM/stats/documents/2007/12/confidentiality/wp.25.e.pdf.
121. Gomatam S. and Karr A. 2003 Distortion measures for categorical data swapping. Technical Report 131, National Institute of Statistical Sciences.
122. Gouweleeuw J.M., Kooiman P.,Willenborg L.C.R.J. and deWolf P.P. 1997 Post randomisation for statistical disclosure control: Theory and implementation. Technical report, Statistics Netherlands. Research paper no. 9731.
123. Gouweleeuw J.M.,Kooiman P.,Willenborg L.C.R.J. and deWolf P.P. 1998a Post randomisation for statistical disclosure control: theory and implementation. Journal of Official Statistics 14(4), 463-478.
124. Gouweleeuw J.M., Kooiman P., Willenborg L.C.R.J. and de Wolf P.P. 1998b The post randomisation method for protecting microdata.Qüestiió-Quaderns d'Estadí{dotless}stica i Investigació Operativa 22(1), 145-156.
125. Graham P. and Penny R. 2005 Multiply imputed synthetic data files. Technical report, University of Otago, Christchurch, New Zealand.
126. Greenberg B. 1987 Rank swapping for ordinal data. Washington, DC: U. S. Bureau of the Census (unpublished manuscript).
127. Gross B., Guiblin P. and Merrett K. 2004 Implementing the post randomisation method to the individual sample of anonymised records (SAR) from the 2001 Census. Office for National Statistics, available at http://www.ccsr.ac.uk/sars/events/2004-09-30/gross.pdf.
128. Hafner H. and Lenz R. 2006 Anonymisation of Linked Employer Employee datasets. On CD-ROM accompanying proceedings of Privacy in Statistical Databases, PSD 2006.
129. Hansen S.L. and Mukherjee S. 2003 A polynomial algorithm for optimal univariate microaggregation. IEEE Transactions on Knowledge and Data Engineering 15(4), 1043-1044.
130. HärdleW. 1991 Smoothing Techniques with Implementation in S. Springer-Verlag, New York.
131. Heer G.R. 1993 A bootstrap procedure to preserve statistical confidentiality in contingency tables. In Proceedings of the International Seminar on Statistical Confidentiality (ed. Lievesley D.), pp. 261-271. Office for Official Publications of the European Communities, Luxembourg.
132. Heldal J. 2011 Anonymised integrated event history datasets for researchers. Joint UNECE/Eurostat work session on Statistical Data Confidentiality, Tarragona, 26-28 October 2011. Available at http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2011/29_Norway.pdf.
133. Höhne J. 2004 Varianten von Zufallsüberlagerung (in German). Working paper of the project 'Faktische Anonymisierung wirtschaftsstatistischer Einzeldaten'.
134. Hundepool A., van de Wetering A., Ramaswamy R., de Wolf P.P., Franconi L., Brand R. and Domingo-Ferrer J. 2008 μ-argus version 4.2 Software and User's Manual. Statistics Netherlands, Voorburg NL. http://neon.vb.cbs.nl/casc/mu.htm.
135. Hundepool A., van de Wetering A., Ramaswamy R., de Wolf P.P., Giessing S., Fischetti M., Salazar-González J.J., Castro J. and Lowthian P. 2011 τ -argus 3.5 user manual. Statistics Netherlands, The Hague, The Netherlands.
136. Huntington D.E. and Lyrintzis C.S. 1998 Improvements to and limitations of Latin hypercube sampling. Probabilistic Engineering Mechanics 13(4), 245-253.
137. Ichim D. 2008 Extensions of the re-identification risk measures based on log-linear models. In Privacy in Statistical Databases, PSD 2008 (eds. Domingo-Ferrer J. and Saygın Y.), vol. 5262 of Lecture Notes in Computer Science, pp. 203-212. Springer, Berlin/Heidelberg.
138. Ichim D. 2009 Disclosure control of business microdata: a density based approach. International Statistical Review 77, 196-211.
139. Ichim D. and Foschi F. 2011 Individual disclosure risk measure based on log-liner models Proceedings of the 58th ISI Congress, Dublin, 21-26 August 2011. Available at http://isi2011.congressplanner.eu/pdfs/650395.pdf.
140. Ichim D. and Franconi L. 2006 Calibration estimator for magnitude tabular data protection. On CD-ROM accompanying proceedings of Privacy in Statistical Databases, PSD 2006.
141. Ichim D. and Franconi L. 2007 Disclosure scenario and risk assessment: structure of earnings survey Work session on Statistical Data Confidentiality, Manchester, 17-19 December 2007, pp. 115-123. Methodologies andWorking papers. Eurostat, Luxembourg.Available at http://www.unece.org/fileadmin/DAM/stats/documents/2007/12/confidentiality/wp.12.e.pdf.
142. Ichim D. and Franconi L. 2010 Strategies to achieve sdc harmonisation at European level: multiple countries, multiple files, multiple surveys. In Privacy in Statistical Databases, PSD 2010 (eds. Domingo-Ferrer J. and Magkos E.), vol. 6344 of Lecture Notes in Computer Science, pp. 284-296. Springer, Berlin/Heidelberg.
143. ISI 1985 Declaration on professional ethics. http://www.isi-web.org/about-isi/professionalethics/43-about/about/151-ethics1985.
144. ISI 2010 Declaration on professional ethics. http://www.isi-web.org/images/about/Declaration-EN2010.pdf.
145. IVEware 2011 IVEware: Imputation and Variance Estimation Software, version 0.2. Available at http://www.isr.umich.edu/src/smp/ive/.
146. Jaro M.A. 1989 Advances in record-linkage methodology as applied to matching the 1985 census of Tampa, Florida. Journal of the American Statistical Association 84(406), 414-420.
147. Jewett R. 1993 Disclosure analysis for the 1992 economic census. Technical report. Economic Statistical Methods and Programming Division, Bureau of the Census, Washington, DC. Available at: http://www.census.gov/srd/sdc/Jewett.disc.econ.1992.pdf.
148. Kennickell A.B. 1999 Multiple imputation and disclosure protection: the case of the 1995 survey of consumer finances. In Statistical Data Protection, SDP 98 (ed. Domingo-Ferrer J.), pp. 248-267. Office for Official Publications of the European Communities, Luxembourg.
149. Kim J.J. 1986 A method for limiting disclosure in microdata based on random noise and transformation. Proceedings of the Section on Survey Research Methods, pp. 303-308. American Statistical Association, Alexandria VA.
150. Kim J.J. 1990 Subpopulation estimation for the masked data. Proceedings of the ASA Section on Survey Research Methods, pp. 456-461. American Statistical Association, Alexandria VA.
151. Kooiman P.,Willenborg L. and Gouweleeuw J. 1998 PRAM: a method for disclosure limitation of microdata. Technical report, Statistics Netherlands (Voorburg, NL).
152. Kuha J.T. and Skinner C.J. 1997 Categorical data analysis and misclassification In Survey Measurement and Process Quality (eds. Lyberg L., Biemer P., Collins M., de Leeuw E., Dippo C., Schwarz N. and Trewin D.), Chapter 28. John Wiley and Sons, New York.
153. Lambert D. 1993 Measures of disclosure risk and harm. Journal of Official Statistics 9(3), 313-331.
154. Laszlo M. and Mukherjee S. 2005 Minimum spanning tree partitioning algorithm for microaggregation. IEEE Transactions on Knowledge and Data Engineering 17(7), 902-911.
155. Laszlo M. and Mukherjee S. 2009 Approximation bounds for minimum information loss microaggregation. IEEE Transactions on Knowledge and Data Engineering 21(11), 1643-1647.
156. Lenz R. 2010 Methoden der Geheimhaltung wirtschaftsstatistischer Einzeldaten und ihre Schutzwirkung. Statistisches Bundesamt, Wiesbaden.
157. Lenz R. and Vorgrimler D. 2005 Matching German turnover tax statistics. Technical Report FDZ-Arbeitspapier Nr. 4, Statistische Ämter des Bundes und der Länder-Forschungsdatenzentren.
158. Liew C.K., Choi U.J. and Liew C.J. 1985 A data distortion by probability distribution. ACM Transactions on Database Systems 10, 395-411.
159. Little R.J.A. 1993 Statistical analysis of masked data. Journal of Official Statistics 9, 407-426.
160. Little R.J.A., Liu F. and Raghunathan T.E. 2004 Statistical disclosure techniques based on multiple imputation. In Applied Bayesian Modeling and Causal Inference from Incomplete-Data Perspectives (eds. Gelman A. and Meng X.L.), pp. 141-152. Wiley, New York.
161. Lochner K., Bartee S., Wheatcroft G. and Cox C. 2008 A practical approach to balancing data confidentiality and research needs: the NHIS linked mortality files. In Privacy in Statistical Databases, PSD 2008 (eds. Domingo-Ferrer J. and Saygın Y.), vol. 5262 of Lecture Notes in Computer Science, pp. 90-99. Springer, Berlin/Heidelberg.
162. Loeve A. 2001 Notes on sensitivity measures and protection levels. Technical report, Research paper, Statistics Netherlands. Available at http://neon.vb.cbs.nl/casc/related/marges.pdf.
163. Lucero J., Freiman M., Singh L., You J., DePersio M. and Zayatz L. 2011 The microdata analysis system at the U.S. Census Bureau. SORT-Statistics and Operations Research Transactions 35, 77-98. Special issue on privacy in statistical databases.
164. Map O.T. 2007. Available at http://lehd.did.census.gov/.
165. Massell P. and Funk J. 2007 Recent developments in the use of noise for protecting magnitude data tables: balancing to improve data quality and rounding that preserves protection. Proceedings of the Research Conference of the Federal Committee on Statistical Methodology. Arlington, Virginia.
166. Mateo-Sanz J.M. and Domingo-Ferrer J. 1999 A method for data-oriented multivariate microaggregation. In Statistical Data Protection, SDP 98 (ed. Domingo-Ferrer J.), pp. 89-99. Office for Official Publications of the European Communities, Luxembourg.
167. Mateo-Sanz J.M., Domingo-Ferrer J. and Sebé F. 2005 Probabilistic information loss measures in confidentiality protection of continuous microdata. Data Mining and Knowledge Discovery 11(2), 181-193.
168. Mateo-Sanz J.M., Martí{dotless}nez-Ballesté A. and Domingo-Ferrer J. 2004a Fast generation of accurate synthetic microdata. In Privacy in Statistical Databases, PSD 2004 (eds. Domingo-Ferrer J. and Torra V.), vol. 3050 of Lecture Notes in Computer Science, pp. 298-306. Springer, Berlin/Heidelberg.
169. Mateo-Sanz J.M., Sebé F. and Domingo-Ferrer J. 2004b Outlier protection in continuous microdata masking. In Privacy in Statistical Databases, PSD 2004 (eds. Domingo-Ferrer J. and Torra V.), vol. 3050 of Lecture Notes in Computer Science, pp. 201-215. Springer, Berlin/Heidelberg.
170. Meindl B. 2009 Linking complementary cell suppression and the software R. Paper presented at the NTTS Conference, Brussels, 18-20 February 2009.
171. Meindl B. 2011 Package sdcTable. Available at http://cran.r-project.org/web/packages/sdcTable/sdcTable.pdf.
172. Mitra R. and Reiter J.P. 2006 Adjusting survey weights when altering identifying design variables via synthetic data. In Privacy in Statistical Databases, PSD 2006 (eds. Domingo-Ferrer J. and Franconi L.), vol. 4302 of Lecture Notes in Computer Science, pp. 177-188. Springer, Berlin/Heidelberg.
173. Moore R. 1996 Controlled data swapping techniques for masking public use microdata sets. U. S. Bureau of the Census, Washington, DC. Available at: http://www.census.gov/srd/papers/pdf/rr96-4.pdf.
174. Muralidhar K. and Sarathy R. 2006 Data shuffling: a new masking approach for numerical data. Management Science 52(5), 658-670.
175. Muralidhar K. and Sarathy R. 2008 Generating sufficiency-based non-synthetic perturbed data. Transactions on Data Privacy 1(1), 17-33. Available at http://www.tdp.cat/issues/tdp.a005a08.pdf.
176. National Center for Health Statistics 2011 National health interview survey linked mortality public use file. Available at http://www.cdc.gov/nchs/data_access/data_linkage/mortality/nhis_linkage_public_use.htm.
177. Nayak T.K., Sinha B. and Zayatz L. 2010 Statistical properties of multiplicative noise masking for confidentiality protection. Technical report, Statistical Research Division Research Report Series (Statistics 2010-05). U.S. Census Bureau. Available at http://www.census.gov/srd/papers/pdf/rrs2010-05.pdf.
178. Oganian A. 2010 Multiplicative noise protocols. Privacy in Statistical Databases, PSD 2010, vol. 6344 of Lecture Notes in Computer Science, pp. 107-117. Springer, Berlin.
179. Oganian A. 2011 Multiplicative noise for masking numerical microdata with constraints. SORTStatistics and Operations Research Transactions 35, 99-112. Special issue on privacy in statistical databases.
180. Oganian A. and Domingo-Ferrer J. 2001 On the complexity of optimal microaggregation for statistical disclosure control. Statistical Journal of the United Nations Economic Comission for Europe 18(4), 345-354.
181. ONS 2011 Registrars general's agreement. Available at http://www.ons.gov.uk/ons/guidemethod/census/2011/the-2011-census/the-2011-census-project/national-statistican-andregistrars-agreement-september-2011.pdf.
182. Paas G. 1988 Disclosure risk and disclosure avoidance for microdata. Journal of Business and Economic Statistics 6, 487-500.
183. Pagliuca D. and Seri G. 1999 Some results of individual ranking method on the system of enterprise accounts annual survey. Esprit SDC Project, Deliverable MI-3/D2.
184. Parzen E. 1962 On estimation of a probability density and mode. Annals of Mathematical Statistics 35, 1065-1076.
185. Pink B. 2009 Principles and guidelines on confidentiality aspects of data integration UNECE United Nations Economic commission for Europe. Available at http://www.unece.org/stats/publications/Confidentiality_aspects_data_integration.pdf.
186. Polettini S. 2004 Some remarks on the individual risk methodology. Work session on Statistical Data Confidentiality, Luxembourg, 7-9 April 2003, pp. 299-311. Monographs in Official Statistics. Eurostat, Luxembourg. Available at http://www.unece.org/fileadmin/DAM/stats/documents/2003/04/confidentiality/wp.18.e.pdf.
187. Polettini S., Franconi L. and Stander J. 2002 Model based disclosure protection. In Inference Control in Statistical Databases (ed. Domingo-Ferrer J.), vol. 2316 of Lecture Notes in Computer Science, pp. 83-96. Springer, Berlin/Heidelberg.
188. Raghunathan T.E., Lepkowski J.M., van Hoewyk J. and Solenberger P. 2001 A multivariate technique for multiply imputing missing values using a series of regression models. Survey Methodology 27, 85-96.
189. RaghunathanT.E., Reiter J.P. and Rubin D.B. 2003 Multiple imputation for statistical disclosure limitation. Journal of Official Statistics 19(1), 1-16.
190. Reiss S.P. 1984 Practical data-swapping: the first steps. ACMTransactions on Database Systems 9, 20-37.
191. Reiss S.P., Post M.J. and Dalenius T. 1982 Non-reversible privacy transformations. Proceedings of the ACM Symposium on Principles of Database Systems, pp. 139-146. ACM, Los Angeles, CA.
192. Reiter J.P. 2002 Satisfying disclosure restrictions with synthetic data sets. Journal of Official Statistics 18(4), 531-544.
193. Reiter J.P. 2003 Inference for partially synthetic, public use microdata sets. SurveyMethodology 29, 181-188.
194. Reiter J.P. 2004 Simultaneous use of multiple imputation for missing data and disclosure limitation. Survey Methodology 30, 235-242.
195. Reiter J.P. 2005a Releasing multiply-imputed, synthetic public use microdata: an illustration and empirical study. Journal of the Royal Statistical Society, Series A 168, 185-205.
196. Reiter J.P. 2005b Significance tests for multi-component estimands from multiply-imputed, synthetic microdata. Journal of Statistical Planning and Inference 131(2), 365-377.
197. Reiter J.P. and Drechsler J. 2010 Releasing multiply-imputed synthetic data generated in two stages to protect confidentiality. Statistica Sinica 20(1), 405-422.
198. Reiter J.P. and Mitra R. 2009 Estimating risks of identification disclosure in partially synthetic data. Journal of Privacy and Confidentiality 1(1), 99-110.
199. Repsilber R.D. 1994 Preservation of confidentiality in aggregated data. Paper presented at the Second International Seminar on Statistical Confidentiality, Luxembourg, 1994.
200. Repsilber R.D. 2002 Sicherung persönlicher Angaben in tabellendaten Landesamt für Datenverarbeitung und Statistik NRW, Ausgabe 1/2002 (in German) Statistische Analysen und Studien Nordrhein-Westfalen.
201. Rinott Y. and Shlomo N. 2006 A generalized negative binomial smoothing model for sample disclosure risk estimation. In Privacy in Statistical Databases, PSD 2006 (eds. Domingo-Ferrer J. and Franconi L.), vol. 4302 of Lecture Notes in Computer Science, pp. 82-93. Springer, Berlin/Heidelberg.
202. Rinott Y. and Shlomo N. 2007 A smoothing model for sample disclosure risk estimation. Tomography, Networks and Beyond, vol. 54 of IMS Lecture Notes-Monograph series Complex Datasets and Inverse Problems, pp. 161-171.
203. Ritchie F. 2007a Disclosure detection in research environments in practice. Work session on Statistical Data Confidentiality, Manchester, 17-19 December 2007, pp. 399-406. Methodologies and Working papers. Eurostat, Luxembourg. Available at http://www.unece.org/fileadmin/DAM/stats/documents/2007/12/confidentiality/wp.37.e.pdf.
204. Ritchie F. 2007b Statistical disclosure control in a research environment. Technical Report Mimeo, Office for National Statistics.
205. Robertson D. 1993 Cell suppression at Statistics Canada. Proceedings Annual Research Conference, U.S. Bureau of the Census.
206. Robertson D. 1994 Automated disclosure control at Statistics Canada. Paper presented at the Second International Seminar on Statistical Confidentiality, Luxembourg, 1994.
207. Robertson D. 2000 Improving Statistics Canada's cell suppression software (confid). In Proceedings in Computational Statistics 2000 (eds. Bethlehem J.G. and van der Hejden P.G.M.), vol. COMPSTAT Proceedings in Computational Statistics 2000. Physica-Verlag, Heidelberg/ New York.
208. Roque G.M. 2000 Masking Microdata Files with Mixtures of Multivariate Normal Distributions PhD thesis University of California at Riverside.
209. Rosemann M. 2003 Erste ergebnisse von vergleichenden untersuchungen mit anonymisierten und nicht anonymisierten einzeldaten am beispiel der kostenstrukturerhebung und der umsatzsteuerstatistik. In Anonymisierung wirtschaftsstatistischer Einzeldaten (eds. Ronning G. and Gnoss R.), pp. 154-183. Statistisches Bundesamt, Wiesbaden, Germany.
210. Rosenblatt M. 1956 Remarks on some non-parametric estimates of a density function. Annals of Mathematical Statistics 27, 642-669.
211. Rubin D.B. 1987 Multiple Imputation for Nonresponse in Surveys. Wiley, New York.
212. Rubin D.B. 1993 Discussion of statistical disclosure limitation. Journal of Official Statistics 9(2), 461-468.
213. Salazar-González J.J. 2008 Statistical confidentiality: optimization techniques to protect tables. Computers and Operations Research 35, 1638-1651.
214. Salazar-González J.J., Staggermeier A. and Bycroft C. 2006 Controlled rounding implementation. Work session on Statistical Data Confidentiality, Geneva, 9-11 November 2005, pp. 303-308. Monographs in Official Statistics. Eurostat, Luxembourg. Available at http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2005/wp.36.e .pdf.
215. Samarati P. 2001 Protecting respondents' identities in microdata release. IEEE Transactions on Knowledge and Data Engineering 13(6), 1010-1027.
216. Samarati P. and Sweeney L. 1998 Protecting privacy when disclosing information: k-anonymity and its enforcement through generalization and suppression. Technical report, SRI International.
217. Sande G. 1984 Automated cell suppression to preserve confidentiality of business statistics. Statistical Journal of the United Nations 2, 33-41.
218. Sande G. 1999 Structure of the ACS automated cell suppression system. Proceedings of the Joint Eurostat/UNECE work session on Statistical Confidentiality, Thessaloniki, 8-10 March 1999, pp. 105-121. Available at http://www.unece.org/fileadmin/DAM/stats/documents/1999/03/confidentiality/9.e.pdf.
219. Sande G. 2002 Exact and approximate methods for data directed microaggregation in one or more dimensions. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems 10(5), 459-476.
220. Sarathy R. and Muralidhar K. 2011 Evaluating Laplace noise addition to satisfy differential privacy for numeric data. Transactions on Data Privacy 4(1), 1-17.
221. Schmid M. 2006 Estimation of a linear model under microaggregation by individual ranking. Allgemeines Statistisches Archiv 90(3), 419-438.
222. Schmid M. and Schneeweiss H. 2009 The effect of microaggregation by individual ranking on the estimation of moments. Journal of Econometrics 153(2), 174-182.
223. Schmid M., Schneeweiss H. and Küchenhoff H. 2007 Estimation of a linear regression under microaggregation with the response variable as a sorting variable. Statistica Neerlandica 61(4), 407-431.
224. Schmidt K. and Giessing S. 2011 A SAS-tool for managing secondary cell suppression on sets of linked tables by τ -argus modular. Poster presented at the NTTS conference, Brussels, 22-24 February 2011. Available at http://www.cros-portal.eu/sites/default/files/PS1 Poster 7.pdf.
225. Schneeweiss H., Rost D. and Schmid M. 2011 Probability and quantile estimation from individually micro-aggregated data. Metrika 1-22. Doi: 10.1007/s00184-011-0349-5.
226. Sebé F., Domingo-Ferrer J., Mateo-Sanz J.M. and Torra V. 2002 Post-masking optimization of the tradeoff between information loss and disclosure risk in masked microdata sets. In Inference Control in Statistical Databases (ed. Domingo-Ferrer J.), vol. 2316 of Lecture Notes in Computer Science, pp. 163-171. Springer, Berlin/ Heidelberg.
227. Shlomo N. and Young C. 2006a Information loss measures for frequency tables. Work session on Statistical Data Confidentiality, Geneva, 9-11 November 2005, pp. 277-289. Monographs in Official Statistics. Eurostat, Luxembourg. Available at http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2005/wp.33.e.pdf.
228. Shlomo N. and Young C. 2006b Statistical disclosure control methods through a risk-utility framework. In Privacy in Statistical Databases, PSD 2006 (eds. Domingo-Ferrer J. and Franconi L.), vol. 4302 of Lecture Notes in Computer Science, pp. 68-81. Springer, Berlin/Heidelberg.
229. Silverman B.W. 1982 Kernel density estimation using the fast Fourier transformation. Applied Statistics 31, 93-97.
230. Singh A.C., Yu F. and Dunteman G.H. 2004 MASSC: a new data mask for limiting statistical information loss and disclosure. Work session on Statistical Data Confidentiality, Luxembourg, 7-9 April 2003, pp. 373-394 Monographs in Official Statistics. Eurostat, Luxembourg.
231. SIPP 2007 U.S. Survey of Income and Program Participation. Available at http://www.census.gov/sipp/synth_data.html.
232. Skinner C. 2008 Assessing disclosure risk for record linkage. In Privacy in Statistical Databases, PSD 2008 (eds. Domingo-Ferrer J. and Saygın Y.), vol. 5262 of Lecture Notes in Computer Science, pp. 166-176. Springer, Berlin/Heidelberg.
233. Skinner C.J. and Holmes D.J. 1998 Estimating the re-identification risk per record in microdata. Journal of Official Statistics 14, 361-372.
234. Skinner C.J. and Shlomo N. 2008 Assessing disclosure risk in survey microdata using log-linear models. Journal of the American Statistical Association 103, 989-1001.
235. Solanas A. and DiPietro R. 2008 A linear-time multivariate microaggregation for privacy protection in uniform very large data sets. In 5th International Conference on Modeling Decisions in Artificial Intelligence-MDAI 2008 (eds. Torra V. and Narukawa Y.), vol. 5285 of Lecture Notes in Computer Science, pp. 203-214. Springer, Berlin.
236. Solanas A. and Martí{dotless}nez-Ballesté A. 2006 V-MDAV: a multivariate microaggregation with variable group size. In COMPSTAT 2006-Proceedings of the 17th Symposium in Computational Statistics (eds. Rizzi A. and Vichi M.), pp. 917-926. Physica Verlag, Heidelberg.
237. Solanas A., Martí{dotless}nez-Ballesté A., Domingo-Ferrer J. and Mateo-Sanz J.M. 2006 A 2d -treebased blocking method for microaggregating very large data sets. Proceedings of the 1st International Conference on Availability, Reliability and Security-ARES 2006, pp. 922-928. IEEE Computer Society, Los Alamitos, CA.
238. Soria-Comas J. and Domingo-Ferrer J. 2011 Optimal random noise distributions for differential privacy. manuscript.
239. Stuart A. and Ord J.K. 1994 Kendall's Advanced Theory of Statistics, Volume 1: Distribution Theory (6th Edition). Arnold, London.
240. Sullivan G.R. 1989 The Use of Added Error to Avoid Disclosure in Microdata Releases. PhDthesis Iowa State University.
241. Sweeney L. 2002a Achieving k-anonymity privacy protection using generalization and suppression. International Journal of Uncertainty, Fuzziness and Knowledge Based Systems 10(5), 571-588.
242. Sweeney L. 2002b k-anonimity: a model for protecting privacy. International Journal of Uncertainty, Fuzziness and Knowledge Based Systems 10(5), 557-570.
243. Templ M. 2008 Statistical disclosure control for microdata using the R-package sdcMicro. Transactions on Data Privacy 1(2), 67-85.
244. Templ M. and Meindl B. 2008 Robust statistics meets SDC: new disclosure risk measures for continuous microdata masking. In Privacy in Statistical Databases, PSD 2008 (eds. Domingo-Ferrer J. and Saygın Y.), vol. 5262 of Lecture Notes in Computer Science, pp. 177-189. Springer, Berlin/Heidelberg.
245. Templ M. and Petelin T. 2009 A graphical user interface for microdata protection which provides reproducibility and interactions: the sdcMicro GUI. Transactions on Data Privacy 2(3), 207-224.
246. Tendick P. 1991 Optimal noise addition for preserving confidentiality in multivariate data. Journal of Statistical Planning and Inference 27, 341-353.
247. Tendick P. and Matloff N. 1994 A modified random perturbation method for database security. ACM Transactions on Database Systems 19, 47-63.
248. Thomas W., Gregory A. and Hamilton A. 2011 Metadata standards to support controlled access to microdata. Joint UNECE/Eurostat work session on Statistical Data Confidentiality, Tarragona, 26-28 October 2011. Available at http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2011/41_Thomas.pdf.
249. Torra V. 2004 Microaggregation for categorical variables: a median based approach. In Privacy in Statistical Databases, PSD 2004 (eds. Domingo-Ferrer J. and Torra V.), vol. 3050 of Lecture Notes in Computer Science, pp. 162-174. Springer, Berlin/Heidelberg.
250. Torra V. and Domingo-Ferrer J. 2003 Record linkage methods for multidatabase data mining. In Information Fusion in Data Mining (ed. Torra V.), pp. 101-132. Springer, Germany.
251. Trewin D. 2007 Principles and guidelines of good practice for managing statistical confidentiality and microdata access. Available at http://www.unece.org/fileadmin/DAM/stats/documents/tfcm/1.e.pdf.
252. Trottini M. 2003 Decision models for data disclosure limitation. PhD thesis Carnegie Mellon University.
253. Trottini M., Franconi L. and Polettini S. 2006 Italian Household Expenditure Survey: a proposal for data dissemination. In Privacy in Statistical Databases, PSD 2006 (eds. Domingo-Ferrer J. and Franconi L.), vol. 4302 of Lecture Notes in Computer Science, pp. 318-333. Springer, Berlin/Heidelberg.
254. Truta T., Fotouhi F. and Barth-Jones D. 2006 Global disclosure risk for microdata with continuous attributes. In Privacy and Technologies of Identity (eds. Strandburg K. and Raicu D.S.), pp. 350-363. Springer, US.
255. UNECE 2001 Statistical data confidentiality in the transition countries: 2000/2001 winter survey. Paper presented at joint UNECE/Eurostat work session on Statistical Data Confidentiality, Skopje, 14-16 March 2001.Available at http://www.unece.org/fileadmin/DAM/stats/documents/2001/03/confidentiality/43.e.pdf.
256. U.S. Bureau of Census 2007 Statistical disclosure control (SDC) checklist. Available at hhtp://www.census.gov/srd/sdc/.
257. Vale S. 2011 Update on UNECE principles and guidelines Paper presented at the Joint UNECE/Eurostat work session on Statistical Data Confidentiality, Tarragona, 26-28 October 2011. Available at http://www.unece.org/fileadmin/DAM/stats/documents/ece/ces/ge.46/2011/33_UNECE.pdf.
258. van den Hout A. 2000 The Analysis of Data Perturbed by PRAM. Delft University Press, Delft, The Netherlands.
259. van den Hout A. 2004 Analyzing misclassified data: randomized response and post randomization. PhD thesis Utrecht University.
260. van den Hout A. and Elamir E.A.H. 2006 Statistical disclosure control using post randomisation: variants and measures for disclosure risk. Journal of Offcial Statistics 22, 711-731.
261. van den Hout A. and van der Heijden P.G.M. 2002 Randomized response, statistical disclosure control and misclassification, a review. International Statistical Review 70, 269-288.
262. Warner S.L. 1965 Randomized response: a survey technique for eliminating evasive answer bias. Journal of the American Statistical Association 60, 63-69.
263. Willenborg L.C.R.J. and de Waal A.G. 1996 Statistical Disclosure Control in Practice. Springer-Verlag, New York.
264. Willenborg L.C.R.J. and de Waal A.G. 2001 Elements of Statistical Disclosure Control. Springer-Verlag, New York.
265. WinklerW.E. 1999 Re-identification methods for evaluating the confidentiality of analytically valid microdata. Statistical Data Protection, Proceedings of the conference, Lisbon, 25-27 March 1998, pp. 319-335. Eurostat, Luxembourg. (Journal version in Research in Official Statistics, vol. 1, no. 2, pp. 50-69, 1998. Also available at http://neon.vb.cbs.nl/casc/related/Sdp_98_2.pdf).
266. WinklerW.E. 2004a Masking and re-identification methods for public-use microdata: overview and research problems. In Privacy in Statistical Databases, PSD 2004 (eds. Domingo-Ferrer J. and Torra V.), vol. 3050 of Lecture Notes in Computer Science, pp. 231-246. Springer, Berlin/Heidelberg.
267. WinklerW.E. 2004b Re-identification methods for masked microdata. In Privacy in Statistical Databases, PSD 2004 (eds. Domingo-Ferrer J. and Torra V.), vol. 3050 of Lecture Notes in Computer Science, pp. 216-230. Springer, Berlin/Heidelberg.
268. Woodcock S.D. and Benedetto G. 2007 Distribution-preserving statistical disclosure limitation. Available at SSRN: http://ssrn.com/abstract=931535.
269. Yancey W.E., Winkler W.E. and Creecy R.H. 2002 Disclosure risk assessment in perturbative microdata protection. In Inference Control in Statistical Databases 2002 (ed. Domingo-Ferrer J.), vol. 2316 of Lecture Notes in Computer Sciencer, pp. 135-152. Springer, Berlin/Heidelberg.
270. Zayatz L. 2007 New implementations of noise for tabular magnitude data, synthetic tabular frequency and microdata, and a remote microdata analysis system. Work session on Statistical Confidentiality, Manchester, 17-19 December 2007, pp. 147-157 Methodologies and Working papers. Eurostat, Luxembourg.
271. Zwick T. 2005 Continuing vocational training forms and establishment productivity in Germany. German Economic Review 6(2), 155-184.