Statistical Disclosure Control at Statistics Sweden Karin Andersson

Statistical Disclosure Control at Statistics Sweden Karin Andersson, Process Dept Ingegerd Jansson, R&D Dept Nordic Forum for Geography and Statistics Sweden 2015 1

Legal premise • Data collected for official statistics are by the main rule confidential (Offentlighets- och sekretesslag 2009: 400) • Exceptions from the legislation make it possible to publish statistics and to use data for research purposes, if it can be guaranteed that a disclosure will not cause harm or damage to an individual, household or establishment • Balance between the statistical notion of disclosure risk and the ”soft” assessment of harm • In addition: reputation of the statistical agency and trust in the system of official statistics 2

Work so far • Decisions on dissemination of aggregated data are taken locally within the organization • Since 2007: Moving towards standardization: common methodology and common IT-tools • • • Handbook Training Common IT-tool mainly for magnitude data: Bifrost Implementation in a number of surveys Solution for Census 2011 Ongoing project: method for frequency tables from registers 3

Bifrost 4

Current work Not yet solved: common methodology and IT-tool for frequency tables • Frequency tables generated from the registers • Large in size • Large numbers of tables published on the same population • Complex relationships between tables • Based on totally enumerated populations • Necessary to have common methodology and highly automated procedures 5

ABS Census Table. Builder Protection Method • Implemented by ABS in their online tool • Perturbative method – a small amount of noise is added to the original cell values in a manner that balances protection against utility - optimization problem • Each cell is perturbed in the same way every time it is requested: consistency between tables • Hierarchies or other complex tables or different choices of background variables doesn´t matter • All cells are protected separately: sums of protected cell values might not equal the corresponding protected margins • Protects against differencing: take the difference between tables for similar subpopulations and find the data for a much smaller subpopulation 6