Disclosure-Protected Inference with Linked Microdata Using a Remote Analysis Server

Abstract

Large amounts of microdata are collected by data custodians in the form of censuses and administrative records. Often, data custodians will collect different information on the same individual. Many important questions can be answered by linking microdata collected by different data custodians. For this reason, there is very strong demand from analysts, within government, business, and universities, for linked microdata. However, many data custodians are legally obliged to ensure the risk of disclosing information about a person or organisation is acceptably low. Different authors have considered the problem of how to facilitate reliable statistical inference from analysis of linked microdata while ensuring that the risk of disclosure is acceptably low. This article considers the problem from the perspective of an Integrating Authority that, by definition, is trusted to link the microdata and to facilitate analysts' access to the linked microdata via a remote server, which allows analysts to fit models and view the statistical output without being able to observe the underlying linked microdata. One disclosure risk that must be managed by an Integrating Authority is that one data custodian may use the microdata it supplied to the Integrating Authority and statistical output released from the remote server to disclose information about a person or organisation that was supplied by the other data custodian. This article considers analysis of only binary variables. The utility and disclosure risk of the proposed method are investigated both in a simulation and using a real example. This article shows that some popular protections against disclosure (dropping records, rounding regression coefficients or imposing restrictions on model selection) can be ineffective in the above setting.

Dynamic data science and official statistics

“…A vanguard project has been the UMETRICS initiative, in which university administrative data on federally funded research have been linked to U.S. Census Bureau data on job placements and earnings of doctoral recipients to measure the ongoing economic impact of university research (Zolas et al, ). Increased use of personal identifiers for linkage has led to a concomitant need for research into privacy and confidentiality protection with linked data; see, for example, the article by Chipperfield ().…”

Prospects for Protecting Business Microdata when Releasing Population Totals via a Remote Server

“…The ABS has developed an approach that could be used to release confidentialised totals from business data through its remote server, called TableBuilder. A simple model for a remote server (Chipperfield and O'Keefe 2014;Chipperfield 2014;O'Keefe and Chipperfield 2013;Thompson et al 2013) is: (1) an analyst submits a query (i.e., request for a table) to the remote server; (2) the remote server automatically modifies or restricts the query's output; (3) the server sends the modified output to the analyst. Tambay (2017) use the ideas of a remote server (specifically TableBuilder) while also perturbing the underlying micro-data.…”