Designing Confidentiality on the Fly Methodology – Three Aspects

Differential privacy and noisy confidentiality concepts for European population statistics

“…find F = 3, M = 2 and T = 11 with E = 2 known, which discloses true F = 5, M = 4 and T = 9. 16 However, the abundance of such noise combinations in the output depends again on p 1 described above (or its generalisation for > 2 categories), and thus becomes increasingly unlikely in the "quasi-unbounded" regime (V E 10): The authors of [13] estimate such risks in a typical scenario as O(10 −3 − 10 −16 ), but assuming E = 2 fixed, while similar risk scaling with E = 1, 2 or 5 (for fixed V ) is observed in [32]. Fig.…”

“…During the project work, considerable efforts were made to provide more flexible and accessible SDC tools [21] but also to assess disclosure risks vs. utility and improve the general methodology [30,32,31]. Also the findings of this paper (see section 5) suggest that the ESS recommended CK method stands as a good practice, if applied correctly and consistently, featuring in particular superior utility properties in various output scenarios with still small and controllable disclosure risks.…”

“…Within the legal framework for EU censuses 31 , statistical confidentiality and SDC measures are under the responsibility of the national statistical authorities of the Member States, so that confidential data must not be submitted to Eurostat. 32 This means that Eurostat will not receive, maintain or process any confidential data (or personal data in GDPR sense) related to the upcoming 2021 EU census round. This has lead to various ESS level projects facilitated by Eurostat and aimed at developing common ESS recommendations for harmonised methods [19] and tools [20] to protect census outputs at the national level.…”

Towards Demand-Driven On-The-Fly Statistics

“…While on-thefly disclosure control is a critical component for such a framework to be put into actual use, we exclude it in this article. First, there are numerous references to research on the topic (see, e.g., Thompson and Broadfoot et al 2013;Marley and Leaver 2011;Fraser and Wooton 2006;Enderle and Giessing et al 2006) and we have little to contribute on the matter, other than point the reader in the direction of the promising notion of differential privacy Ji et al (2014). Second, even without on-the-fly disclosure control, the technicalities involved in our framework are nontrivial and, we feel, constitute a field of research that is relevant on its own.…”