Philip Lowthian, Neil Higgins

1
Philip Lowthian, Neil Higgins Christine
Bycroft, Statistical Disclosure Control
Centre,Methodology Directorate, Office for
National Statistics
Best Practice for Confidentiality Protection of
ONS tabular outputs
2
The Ultimate Aim
The production of consistent methods and tools
for families of outputs
Best Practice Documentation
Common Tools
3
Summary of Presentation

• Why the need for a guide to Best Practice
• Obtaining the details on current disclosure
  control methods
• What we found about current methods
• What is to be included in the Best Practice guide
• Some details on the recommended tool

4
Why the need for guide to best practice
5
The bridge between confidentiality and useful data
Why the need for guide to best practice
Protect confidentiality of respondents
information
Supply data to users
The deep, dangerous river of loss of reputation
6
Why the need for guide to best practice

• Since 2000 there has been a concentrated effort
  to raise the profile of disclosure control at the
  ONS
• Code of Practice
• Protocol on Confidentiality and Data Access

7
Why the need for guide to best practice

• General principles to be met are in place
• But still a need to interpret in practice
• We are aiming to produce a consistent, coherent
  approach across the ONS
• What methodologies are being used now

8
Obtaining details on current methods
9
Obtaining details on current methods

• Key aspects
• - Why is confidentiality protection needed?
• - Data Utility - what are the data used for?
• - Risk Assessment - where are the disclosure
  risks?
• - Disclosure control method used

10
Obtaining details on current methods

• A number of key businesses areas were identified
• - Business surveys such as ABI 1/2
• - Household surveys such as GHS, LFS
• Our aim was to review a selection of key outputs
  not to review all surveys
• A Questionnaire was designed to determine typical
  outputs and the disclosure methods applied

11
Obtaining details on current methods

• Questionnaire completed as far as possible by SDC
  staff from the database / intranet
• Interview with Data Custodian and/or another
  expert from the business area
• Disclosure control methodology critically
  reviewed by SDC

12
Obtaining details on current methods

• The views of SDC are returned to the business
  area for comment. A process of ongoing
  consultation.
• This lead to the writing of two Reviews of
  business methods
• - Business surveys
• - Household surveys
• This is the stage we are currently at

13
What we have found Business Surveys

14
What we have found Business Surveys

• Disclosure risk
• - To protect against revealing information
  about individual respondents
• - Protected by 1947 Statistics of Trade Act
• - Respondents are told no information relating
  to an individual company will be released

15
What we have found Business Surveys

• Rules to Determine Unsafe Cells
• The rules to detect unsafe cells are generally
  consistent across surveys with some exceptions
  which probably overprotect
• Threshold rule minimum of 3 Enterprise Groups
  contributing to a cell
• p rule value of a business should not be
  deduced to within p of its true value
• This protects against a business in a cell
  finding out about another in the same cell - a
  typical intruder scenario

16
What we have found Business Surveys

• How to protect unsafe cells
• Redesign the table
• Suppress the cells failing the safety rule -
  primary suppression
• Additional suppressions (secondary suppressions)
  required to prevent unsafe cell values being
  re-calculated
• For one dimensional tables these are carried out
  by the common software
• Larger tables - carried out manually. Can be time
  consuming

17
What we have found Business Surveys

Example of the need for secondary suppression
18
What we have found Business Surveys

Therefore secondary suppressions are required
19
What we have found Business Surveys

• Evaluation and Recommendations
• Current standard rules (i.e. a threshold and p
  rule) for determining unsafe cells in magnitude
  tables is Best Practice and should be retained
• Primary and secondary cell suppression should
  continue to be the main method of protecting
  unsafe cells in magnitude tables
• Tables of count data should change protection
  method from the existing conventional rounding to
  controlled rounding

20
What to include in the Best Practice Guide
21

• Key aspects
• - Why is confidentiality protection needed?
• - Data Utility - what are the data used for?
• - Risk Assessment - where are the disclosure
  risks?
• - Disclosure control method used

22
What to include in the Best Practice Guide

• Why is confidentiality protection needed
• The importance of confidentiality protection
• Ethical, legal, practical reasons
• - Obligations made to respondents
• Legislation
• - General Common law
• - Specific Statistics of Trade Act

23
What to include in the Best Practice Guide

• Data Utility - what the data are used for
• - Data source register - IDBR
• sample - ABI etc.
• - Types of outputs Frequency - counts of
  businesses
• Magnitude -
  turnover, expenditure
• - Data Uses ONS, OGD, Commercial use

24
What to include in the Best Practice Guide

• Risk Assessment - particular disclosure risks
• - Risks to protect against
• - identification of an individual business
• - revealing further information about an
  individual business
• - How identification could occur
• - Cells with a small number of contributors or
  dominating contributors
• - Individual businesses combining knowledge

25
What to include in the Best Practice Guide

• Standard disclosure control methods
• - Primary rules Threshold and p rules
• - Secondary suppression Explain the necessity
• - Other methods which must provide the same
  level of protection

26
Recommended Tool

27
Recommended Tool

• Tau-Argus- Recommended tool for disclosure
  control
• - Can read either microdata or tabular data
• - Can run in batch (production) mode
• - Can operate either as a stand alone program or
  linked to Supercross
• - Can apply safety rules and optimise the
  secondary suppressions

28
Further work

• Produce similar guides for
• - Household surveys
• - Abortion data, health data
• - Administrative Data
• - Indices
• All guides to be available on the intranet.
• Possibly very useful for OGDs
• Training to be developed

29
The Ultimate Aim
The production of consistent methods and tools
for families of outputs
Best Practice Documentation
Common Tools