Abstract
The requirement to anonymise data sets that are to be released for secondary analysis should be balanced by the need to allow their analysis to provide efficient and consistent parameter estimates. The proposal in this article is to integrate the process of anonymisation and data analysis. The first stage uses the addition of random noise with known distributional properties to some or all variables in a released (already pseudonymised) data set, in which the values of some identifying and sensitive variables for data subjects of interest are also available to an external ‘attacker’ who wishes to identify those data subjects in order to interrogate their records in the data set. The second stage of the analysis consists of specifying the model of interest so that parameter estimation accounts for the added noise. Where the characteristics of the noise are made available to the analyst by the data provider, we propose a new method that allows a valid analysis. This is formally a measurement error model and we describe a Bayesian MCMC algorithm that recovers consistent estimates of the true model parameters. A new method for handling categorical data is presented. The article shows how an appropriate noise distribution can be determined.
References
1.
Arima, S. and S. Polettini. 2019. “A Unit Level Small Area Model with Misclassified Covariates.” Journal of the Royal Statistical Society , Series A. Early View: DOI: https://doi.org/10.1111/rssa.12468.
2.
Brand, R. 2002. Microdata Protection Through Noise Addition . In Inference control in statistical databases , 97–116. Berlin, Heidelberg: Springer.
3.
Chambers, R.L. and R. Dunstan. 1986. “Estimating Distribution Functions from Survey Data.” Biometrika 73: 597–604. DOI: https://doi.org/10.2307/2336524.
4.
Charest, A.-S. 2010. “How Can we Analyse Differentially-private Synthetic Datasets?” Journal of Privacy and Confidentiality 2: 21–33. DOI: https://doi.org/10.29012/jpc.v2i2.589.
5.
Cox, L., A.F. Karr, and S.K. Kinney. 2011. “Risk-Utility Paradigms for Statistical Disclosure Limitation: How to Think, But Not How to Act.” International Statistical Review 79(2): 160–183. DOI: https://doi.org/10.1111/j.1751-5823.2011.00140.x.
6.
Delaigle, A. and P. Hall. 2008. “Using SIMEX for Smoothing-Parameter Choice in Errors-in-Variables Problems.” Journal of the American Statistical Association 103(481): 280–287.
7.
Duncan, G.T. and S. Mukherjee. 2000. “Optimal Disclosure Limitation Strategy in Statistical Databases: Deterring Tracker Attacks Through Additive Noise.” Journal of the American Statistical Association 95(451): 720–729.
8.
Dwork, C. 2006. “Differential Privacy.” In ICALP 2006 , edited by M. Bugliesi, B. Preneel, V. Sassone, and I. Wegener, 4052: 1–12. Lecture Notes in Computer Science. Heidelberg: Springer.
9.
Dwork, C. and A. Roth. 2014. “The Algorithmic Foundations of Differential Privacy.” Foundations and Trends in Theoretical Computer Science 9: 211–407. DOI: https://doi.org/10.1561/0400000042.
10.
Elliot, M.J. and A. Dale. 1999. “Scenarios of attach: the data intruder’s perspective on statistical disclosure risk.” Netherlands Official Statistics 14: 6–10. Available at: https://www.researchgate.net/profile/Ton_De_Waal/publication/255565237_Exact_disclosure_in_a_super-table/links/0c960539450114582d000000.pdf#page=6 (accessed February 2020).
11.
Fuller, W.A. 1993. “Masking procedures for microdata disclosure limitation.” Journal of Official Statistics 9: 383–406. Available at: https://www.scb.se/contentassets/ca21efb41fee47d293bbee5bf7be7fb3/masking-procedures-for-microdata-disclosure-limitation.pdf (accessed February 2020).
12.
Fuller, W.A. 2006. Measurement error models . Chichester: John Wiley and Sons.
13.
Goldstein, H. 2011. Multilevel Statistical Models . Chichester: Wiley.
14.
Goldstein, H. and W. Browne. 2016. “Multilevel models: current developments”. Wiley Online Library. Available at: www.wileyonlinelibrary.com/ref/stats.
15.
Goldstein, H., W.J. Browne, and C. Charlton. 2017. “An MCMC procedure for handling measurement and misclassification errors alongside missing data in multilevel multi- variate generalised linear models with an application to a study of Australian youth.” Journal of Applied Statistics . DOI: https://doi.org/10.1080/02664763.2017.1322558.
16.
Goldstein, H., J. Carpenter, and M. Kenward. 2018. “Bayesian models for weighted data with missing values: a bootstrap approach.” Journal of the Royal Statistical Society , Series C. DOI: https://doi.org/10.1111/rssc.12259.
17.
Goldstein, H., J. Carpenter, M. Kenward, and K. Levin. 2009. “Multilevel models with multivariate mixed response types.” Statistical Modelling 9(3): 173–197. DOI: https://doi.org/10.1177/1471082X0800900301.
18.
Goldstein, H., J. Rasbash, M. Yang, G. Woodhouse, H. Pan, D. Nuttall, and S. Thomas. 1993. “A Multilevel Analysis of School Examination Results.” Oxford Review of Education 19(4): 425–433.
19.
Gouweleeuw, J., P. Kooiman, L.C.R.J. Willenborg, and P.P. de Wolf. 1998. “Post Randomisation for Statistical Disclosure Control: Theory and Implementation.” Journal of Official Statistics 14: 463–478. Available at: https://pdfs.semanticscholar.org/cd28/1be11657b944b74169b8fe35dddb91d558e8.pdf (accessed February 2020).
20.
Hundepool, A., J. Domingo-Ferrer, L. Francono, S. Giessing, E. Schulte-Nordholt, K. Spicer, and P.P. de Wolf. 2012. Statistical Disclosure Control. Wiley Series in Survey Methodology . Chichester: John Wiley and Sons.
21.
Hwang, J.T. 1986. “Multiplicative Errors-in-Variables Models with Applications to Recent Data” Released by the U.S. Department of Energy. Journal of the American Statistical Association 81(395): 680–688. DOI: https://doi.org/10.1080/01621459.1986.10478321.
22.
Kim, J.J. 1986. A Method for Limiting Disclosure in Micro-data Based on Random Noise and Transformation . ASA Proceedings of the Section on SRM: 370–374. Available at: http://www.asasrms.org/Proceedings/papers/1986_069.pdf (accessed February 2020).
23.
Little, R.J.A. 1993. “Statistical analysis of masked data.” Journal Official Statistics 9: 407–426. Available at: https://www.scb.se/contentassets/ca21efb41fee47d293bbee5bf7be7fb3/statistical-analysis-of-masked-data.pdf (accessed February 2020).
24.
MATLAB. 2017. Available at: https://www.mathworks.com/products/matlab.html (accessed October 2017).
25.
Reiter, J.P. 2005. “Releasing Multiply Imputed, Synthetic Public-Use Microdata: An Illustration and Empirical Study.” Journal of the Royal Statistical Society, Series A 168(1): 185–205. DOI: https://doi.org/10.1111/j.1467-985X.2004.00343.x.
26.
Reiter, J.P. and R. Mitra. 2009. “Estimating Risks of Identification Disclosure in Partially Synthetic Data.” Journal of Privacy and Confidentiality 1(1): 99–110. DOI: https://doi.org/10.29012/jpc.v1i1.567.
27.
Richardson, S. and W.R. Gilks. 1993. “Conditional independence models for epidemiological studies with covariate measurement error.” Statistics in Medicine 12: 1703–1722. DOI: https://doi.org/10.1002/sim.4780121806.
28.
Rinott, Y., C. O’Keefe, N. Shlomo, and C. Skinner. 2018. “Confidentiality and Differential Privacy in the Dissemination of Frequency Tables.” Statistical Sciences 33(3): 358–385. DOI: https://doi.org/10.1214/17-STS641.
29.
Rubin, D.B. 1993. “Discussion Statistical Disclosure Limitation.” Journal of Official Statistics 9: 461–468. Available at: https://www.scb.se/contentassets/ca21efb41-fee47d293bbee5bf7be7fb3/discussion-statistical-disclosure-limitation2.pdf (accessed February 2020).
30.
SdcMicro. 2019. Available at: http://cran.r-project.org/web/packages/sdcMicro/sdcMicro.pdf.
31.
Shlomo, N. 2010. “Measurement Error and Statistical Disclosure Control.” In PSD 2010: Privacy in Statistical Databases , edited by J. Domingo-Ferrer and E. Magkos, 6344: 118–126. Springer LNCS. DOI: https://doi.org/10.1007/978-3-642-15838-4_11.
32.
Shlomo, N. and T. de Waal. 2008. “Protection of Micro-data Subject to Edit Constraints Against Statistical Disclosure.” Journal of Official Statistics 24(2): 1–26. Available at: https://www.scb.se/contentassets/ca21efb41fee47d293bbee5bf7be7fb3/protection-of-micro-data-subject-to-edit-constraints-against-statistical-disclosure.pdf (accessed February 2020).
33.
Shlomo, N. and C.J. Skinner. 2010. “Assessing the Protection Provided by Misclassification-Based Disclosure Limitation Methods for Survey Microdata.” Annals of Applied Statistics 4(3): 1291–1310. DOI: https://doi.org/10.1214/09-AOAS317.
34.
Tendick, P. 1991. “Optimal Noise Addition for Preserving Confidentiality in Multivariate Data.” Journal of Statistical Planning and Inference 27(3): 341–353. DOI: https://doi.org/10.1016/0378-3758(91)90047-I.
35.
Ting, D., S. Fienberg, and M. Trottini. 2008. “Random orthogonal matrix masking methodology for microdata release.” International Journal on Information and Computer Security 2(1): 86–105. DOI: https://doi.org/10.1504/IJICS.2008.016823.
36.
Willenborg, L. and T. de Waal. 2001. “Elements of Statistical Disclosure Control in Practice.” Lecture Notes in Statistics , 155. New York: Springer-Verlag.
37.
Winkler, W.E. 1998. “Re-identification Methods for Evaluating the Confidentiality of Analytically Valid Microdata.” Research in Official Statistics 1: 87–104. Available at: https://www.census.gov/srd/papers/pdf/rrs2005-09.pdf.
38.
Woo, Y.M.J. and A. Slavkovic. 2014. “Generalized Linear Models with Variables Subject to Post Randomization Method.” Italian Journal of Applied Statistics 24(1): 29–56. Available at: http://sa-ijas.stat.unipd.it/sites/sa-ijas.stat.unipd.it/files/2%20Woo%20pg%20(1).pdf (accessed February 2020).