Confidentiality and Disclosure Control: the Restricted Data Access at the Brazilian Institute of Geo

1
Confidentiality and Disclosure Control the
Restricted Data Access at the Brazilian Institute
of Geography and Statistics
Zélia Magalhães Bianchini (Deputy Director for
Surveys IBGE, Brazil) zbianchi_at_ibge.gov.br
Sonia Albieri (Co-ordinator of Methodology
and Quality IBGE, Brazil) salbieri_at_ibge.gov.br
European Conference on Quality in Survey
Statistics Cardiff, UK, 24-26 April 2006
2
Outline

• Focus on
• Procedures implemented and currently in use by
  IBGE in order to permit the access of restricted
  data to external researchers.
• Issues posed during the development of procedures
  to allow access to microdata, while protecting
  data confidentiality.
• Some projects.
• Special issues.
• Future works and comments.

3
Introduction

• IBGE has been releasing public use microdata
  files for households statistics since the early
  1990s.
• Measures taken to protect the confidentiality of
  these microdata include data suppression of
  geographical detail.
• For business data, 1996 Agricultural Census and
  short form 2000 Population Census data, there is
  no public use microdata files release.

4
Introduction

• Pressure of the increasing demand
• advance of technology and
• increase sensitivity to privacy issues,
• have encouraged the development of arrangements
  to provide researcher restricted access to data
  files that the statistical agency does not
  release to the general public (more-in-depth
  analysis than is possible using tabular
  aggregated data).

5
Introduction

• At IBGE, this attendance is done via on-site
  access at the headquarters of the agency.
• There is a private room with special computers
  installed only for the use of researchers working
  on-site. The room was first used in September
  2003
• The security features of the computers for this
  use include
• blockade the network to transfer data and
• disable the external disk drives and serial
  parallel ports.

6
Procedure Steps

• (1) - application
• The researcher submits the research project and
  the project is evaluated if it is
• to be in public or academic interest
• for statistical purpose and
• feasible.

7
Procedure Steps

• (2) - evaluation of the project
• A Committee (created in May of 2003) comprising
  senior staff members from business, methodology
  and dissemination co-ordinations
• evaluates the project, based on subsidies of the
  thematic area responsible for microdata
• authorizes (or not) the access to internal data
  files under the appropriate conditions.

8
Procedure Steps

• (3) - formal agreements to access
• Once a project has been authorized, formal
  agreements between the researcher and the agency
  are established.
• These agreements involve
• written contract (contractual arrangement)
• agreement form outlining the conditions of
  access
• setting fees for the proposed work.

9
Procedure Steps

• (4) - on-site access
• The data bases are installed in the room with
  special computers for the researchers
• the researchers do the work and save the output
  in the hard disk of this computer and then
  prepare a documental report
• a cd-rom with these information is prepared by
  IBGE staff in order to be analysed by the
  thematic area.

10
Procedure Steps

• (5) - evaluation of output
• The statistical output must be analysed before
  released to the researcher to assure the
  technical assessment of disclosure risks and
  confidentiality requirements.
• The analysis is made by the thematic area
  responsible for microdata, the same that gave
  subsidies for the committee decision.

11
Procedure Steps

• (6) - releasing the output
• Once the output of the project has been approved,
  i.e, the thematic area judges that there are no
  risks of disclosure, another formal agreement is
  established.
• This new agreement form outlines the conditions
  of use of the data generated by the special
  access, i.e, the user has to
• recognize that data are property of IBGE and
• inform this when release the results and analysis
  involving these data.

12
Experimental projects

• Before the implementation of this procedure,
  there were some projects/researchers that
  received authorization to special data access, in
  a experimental way.
• The researchers did the work at the thematic area
  offices, with special computers
• 1996 Agricultural Census Data
• 3 projects, during 2 years
• Manufacturing annual surveys
• 1 project, during 3 months

13
Projects analysed
14
Projects analysed

• 37 projects was analysed by the committee from
  September, 2003 to February, 2006.
• only 3 projects involving data from long form of
  2000 Population Census, both because the
  researcher needed different geographical area
  from the weighting area used in the sampling
  weighting process
• 1 project involving data from annual trade
  survey
• 1 project involving data from annual services
  survey
• 30 projects involving data from manufacturing
  surveys and
• 2 projects involving simultaneously data from
  manufacturing, trade or services surveys.

15
Difficulty tasks

• Time-consuming for
• analysing the project
• in many circumstances need to contact the users
  to redesign the project or to provide detailed
  explanations of why the project is not feasible
• the preparation of user-friendly documentation
  for internal files
• analysing the outputs due to faults on the
  documentation.
• Generally, the expected time to work is
  underestimated.

16
Some special issues

• Managing the tension between the NSO and the
  researchers
• Acceptability of current practices
• believe the protections are too limiting
• lack of convenience.
• Managing the risks to avoid suspicion of misuse
  and reaction of respondents.
• Matching of data bases
• Researchers demand to link data sets of the
  agency and other data bases.

17
Future works

• The processes for researchers access to
  restricted microdata should be publicly available
  
• show to respondents and users that decisions
  about access are taken on an objective basis
• be transparent about the arrangements outlining
  that data will be provided to researchers access
  under controlled conditions for specific purpose
  and
• outlining how the results will be accessible to
  the public.

18
Future works

• The IBGE web site is an effective way for
  providing information on how to provide
  researchers access
• nowadays the procedures are only provided through
  intranet and the users are informed about the
  procedures only when ask for special data
• fear of increasing excessively the demand.

19
Future works

• Demand to install other rooms outside the
  headquarters of the agency to attendance via
  on-site access
• big cities of the country (Brasília, São Paulo,
  etc.)
• training of staff and preparation of the
  infrastructure.

20
Final Comments

• It is essential to try to reach the needs of the
  research community while maintaining
  confidentiality and security.
• Providing restricted data access for analysis
  requires collaboration between all involved and
  preparation to deal with a variety of situations
  and questions.
• Despite the limitations we are continuously
  looking for improving in the development process.