Simultaneous edit-imputation and disclosure limitation for business establishment data

Business establishment microdata typically are required to satisfy agency-specified edit rules, such as balance equations and linear inequalities. Inevitably some establishments' reported data violate the edit rules. Statistical agencies correct faulty values using a process known as edit-imputation. Business establishment data also must be heavily redacted before being shared with the public; indeed, confidentiality concerns lead many agencies not to share establishment microdata as unrestricted access files. When microdata must be heavily redacted, one approach is to create synthetic data, as done in the U.S. Longitudinal Business Database and the German IAB Establishment Panel. This article presents the first implementation of a fully integrated approach to edit-imputation and data synthesis. We illustrate the approach on data from the U.S. Census of Manufactures and present a variety of evaluations of the utility of the synthetic data. The paper also presents assessments of disclosure risks for several intruder attacks. We find that the synthetic data preserve important distributional features from the post-editing confidential microdata, and have low risks for the various attacks.     

美国未成年人案件保密性原则及其松动

美国未成年人案件保密性原则在司法实践中比较复杂。基于"双轨制"现实,未成年人身份过错、偏差及轻微犯罪案件通常由少年法院审理;而对于较严重的未成年人刑事案件,则会移送至刑事(成人)法院审理。对于后者,因其刑事性质,被移送受审的未成年人将被视为成年人受审,其案件庭审及记录除特殊情形外原则上不予保密。而对于前者,此类案件大体上适用保密性原则。不过随着对儿童利益最佳原则及防卫社会的双向反思,对在少年司法体系内的较严重犯罪案件与虐待、遗弃及照管不良等案件,少年法院保密性原则亦有较大松动。     

Providing Spatial Data for Secondary Analysis: Issues and Current Practices Relating to Confidentiality

Spatially explicit data pose a series of opportunities and challenges for all the actors involved in providing data for long-term preservation and secondary analysis—the data producer, the data archive, and the data user. We report on opportunities and challenges for each of the three players, and then turn to a summary of current thinking about how best to prepare, archive, disseminate, and make use of social science data that have spatially explicit identification. The core issue that runs through the paper is the risk of the disclosure of the identity of respondents. If we know where they live, where they work, or where they own property, it is possible to find out who they are. Those involved in collecting, archiving, and using data need to be aware of the risks of disclosure and become familiar with best practices to avoid disclosures that will be harmful to respondents.

Confidentiality and Media Attention: A Discussion Concerning Denial and Public Education

The article presents the beginning of a discussion on how the doctrine of confidentiality may have been misapplied in the area of children's protective services. It asks the reader to consider who the client is in these cases and, having answered that question, asks what is the professional responsibility? The whole discussion is linked to the difficulties in dealing with media attention in these cases and offers some experience in the form of case examples. Woven in to the matrix of the above discussion is a clinical and public educational discussion. Preserving confidentiality in its traditional sense can contribute to a preservation of the family secret, namely, child abuse. In that way, a child protection agency can actually be contributing to the maintenance of abuse patterns in a family. Also, with no capacity to speak professionally about specific abuse, the public education impact is diminished.     

When bubbles burst: Mimetic insights into minimising confidentiality breaches

This paper presents a theoretical model to help managers visualise and manage confidential situations more effectively. The model metaphorically likens a confidential setting to the properties of a soap bubble, e.g. elastic expansion or contraction, minimal surface area to contain a given volume, fragility, surface tension, pressure, stress, strain and the potential for bursting thereby releasing the contents to the external environment. We explore the conceptual developments in two phases. Firstly, looking at how a bubble and confidential scenario form and grow. Secondly, we consider how a bubble may burst and map these forces to ways in which confidentiality may be breached. Many attributes are mapped, the key ones being: the embedded value within the system, the criticality of maintaining confidentiality, increasing pressure, the corresponding stress/strain dynamics and the levels of trust between stakeholders. Key research propositions are derived from the model which aims to minimise the risk of a confidentiality breach.     

Some New Results on the Multinomial Randomized Response Model

ABSTRACT

The randomized response technique is an effective survey method designed to elicit sensitive information while ensuring the privacy of the respondents. In this article, we present some new results on the randomization response model in situations wherein one or two response variables are assumed to follow a multinomial distribution. For a single sensitive question, we use the well-known Hopkins randomization device to derive estimates, both under the assumption of truthful and untruthful responses, and present a technique for making pairwise comparisons. When there are two sensitive questions of interest, we derive a Pearson product moment correlation estimator based on the multinomial model assumption. This estimator may be used to quantify the linear relationship between two variables when multinomial response data are observed according to a randomized-response protocol.     

Confidentiality

Abstract

Confidentiality was the ethical dilemma most frequently encountered by Israeli social workers in a 1998 national survey (Linzer, Conboy and Ain, 2002). A reanalysis of survey responses found the social workers cared about preventing violations of client privacy, promoting client self-determination, and respecting client dignity, especially when challenged by: (1) public institutions' right to know, (2) limitations of protection of client communications and information, including duty to warn, (3) child and family dilemmas, (4) informed consent ambiguities, and (5) computers and technology utilization. Social workers looked to their own counsel, colleagues, and supervisor's advice and their professional code of ethics for guidance.     

Preserving data utility via BART

When preparing data for public release, information organizations face the challenge of preserving the quality of data while protecting the confidentiality of both data subjects and sensitive data attributes. Without knowing what type of analyses will be conducted by data users, it is often hard to alter data without sacrificing data utility. In this paper, we propose a new approach to mitigate this difficulty, which entails using Bayesian additive regression trees (BART), in connection with existing methods for statistical disclosure limitation, to help preserve data utility while meeting confidentiality requirements. We illustrate the performance of our method through both simulation and a data example. The method works well when the targeted relationship underlying the original data is not weak, and the performance appears to be robust to the intensity of alteration.     

A new approach for disclosure control in the IAB establishment panel—multiple imputation for a better data access

For micro-datasets considered for release as scientific or public use files, statistical agencies have to face the dilemma of guaranteeing the confidentiality of survey respondents on the one hand and offering sufficiently detailed data on the other hand. For that reason, a variety of methods to guarantee disclosure control is discussed in the literature. In this paper, we present an application of Rubin’s (J. Off. Stat. 9, 462–468, 1993) idea to generate synthetic datasets from existing confidential survey data for public release.We use a set of variables from the 1997 wave of the German IAB Establishment Panel and evaluate the quality of the approach by comparing results from an analysis by Zwick (Ger. Econ. Rev. 6(2), 155–184, 2005) with the original data with the results we achieve for the same analysis run on the dataset after the imputation procedure. The comparison shows that valid inferences can be obtained using the synthetic datasets in this context, while confidentiality is guaranteed for the survey participants.