Dealing with Confidentiality in Dissemination: The experience of the Basque Statistical Office

1. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA Dealing with Confidentiality in Dissemination: The experience of the Basque Statistical Office Joint UNECE/Eurostat work session on statistical data confidentiality Manchester, 17-19 December 2007

2. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA Outline • Objectives • Legal framework and previous work on statistical confidentiality • Current situation at EUSTAT • Confidentiality Board • Establishing confidentiality criteria in dissemination • Checking confidentiality criteria • Future tasks • Towards a safe-standard microdata structure • On-site access facility • Conclusions

3. 1. Objectives

4. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA 1. Objectives • One of the main goals of a statistical agency is to maintain and provide statistical confidentiality for its respondents. • Confidentiality should be preserved in all the stages of statistical production and especially in the dissemination phase. Principle 5 of the European Statistics Code of Practice “[…] Instructions and guidelines are provided on the protection of statistical confidentiality in the production and dissemination processes. These guidelines are spelled out in writing and made known to the public […]”

5. 1. Objectives In order to fulfil this Principle… • A comprehensive confidentiality policy has been developed at Basque Statistics Office (EUSTAT) that includes: • standard protection criteria for dissemination products (tables, microdata) • constitution of an expert group • commitment to future tasks: public-use microfiles and on-site access

6. 2. Legal framework and previous work on statistical confidentiality

7. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA 2.1 Legal framework • Basque Statistics Law (23rd April, Law 4/1986). Chapter IV. • Organic Law of Personal Data Protection (13th December, Law 15/1999) defines the concepts of Personal Data and Specially Protected Data: • European Directive 95/46/EC on the protection of individuals with regard to the processing of personal data defines the concept of identifiable person: “ […] the duty to keep statistical secret protects any identifiable data as belonging to an specific person […]” “Personal Data: any information related to an identified or identifiable person” “[…]an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.[…]

8. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA 2.2 Previous work on statistical confidentiality

9. 2.2 Previous work on statistical confidentiality

10. 2.2 Previous work on statistical confidentiality

11. 3. Current situation at EUSTAT

12. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA 3.1 Confidentiality Board Why? Who? Need for an expert group to make decisions about data protection and to give advice on confidentiality matters. The highest representatives of each thematic area and the General Direction of EUSTAT

13. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA 3.1 Confidentiality Board • Main Duties • To establish rules and criteria about confidentiality issues • To make decisions concerning sensitive topics and sensitive variables • To discuss and approve public-use microdata structure • To decide about on-site access conditions • To solve specific queries (research-use microdata, etc.) • To advise other statistical agents from the Basque statistics system on confidentiality matters and data protection procedures • To keep a coherent and updated system

14. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA 3.2 Establishing confidentiality criteria in dissemination • Research of sources and other experiences - 1st Phase • Objective: Compilation of external experiences from other statistical offices regarding their policies on reporting and implementing confidentiality. • Sources consulted: • National Statistical Institute – INE (Spain) • Statistical Office of the European Communities – EUROSTAT (UE) • Office of National Statistics – ONS (United Kingdom) • Bureau of the Census – (United States) • Central Bureau of Statistics – CBS (The Netherlands) • Satistics Canada – StatCan (Canada)

15. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA 3.2 Establishing confidentiality criteria in dissemination • Research of sources and other experiences - 1st Phase • Results: • Legal framework is available to all sources consulted and it is considered essential as a starting point. • It is less common to find information about the sensitivity rules applied and the values for the parameters of such rules. • Disclosure control methods are applied to tables and microdata in most cases. • Geographical thresholds are applied in many cases with diverse values and mainly in microdata releases. • Almost all the sources provide microdata products (for research use and/or public use)

16. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA 3.2 Establishing confidentiality criteria in dissemination • Research of sources and other experiences – 2nd Phase • Objective: Compilation of data protection practices commonly applied by EUSTAT in dissemination products. • Sources consulted: Representatives of the production areas in EUSTAT. • Results: • Business statistics - Low frequencies in tables are avoided by means of recodification and manual suppressions - No concentration rules are applied to magnitude tables • Social and population statistics - Ad-hoc protection for each particular case

17. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA 3.2 Establishing confidentiality criteria in dissemination • Microdata protection rules • Microdata files released should not include, in any case, either direct identifiers or personal data. • In general, microdata files will not include geographical indicators referring to areas under a fixed threshold (10,000 inhabitants). • Aggregation level for other variables included in the file will depend on geographical level released and sensitivity of the variable itself. • As an additional protection, disclosure control techniques (perturbation methods, record swapping, noise addition, etc.) could be applied to microdata, always preserving the statistical properties of data.

18. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA 3.2 Establishing confidentiality criteria in dissemination • Tabular data protection rules • Low values should be avoided in frequency tables with multiple crossings, where at least one of the variables is sensitive and the geographical indicator refers to an area under a fixed threshold (10,000 inhabitants). • Dominant contributions should be avoided in magnitude tables in order to prevent accurate estimation of sensitive data belonging to a contributor in a cell. Concentration rules will be applied to detect sensitive cells. • Appropriate protection techniques for tabular data (recoding of variables, primary and secondary cell suppression, etc.) will be applied in order to protect sensitive cells from disclosure.

19. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA 3.2 Establishing confidentiality criteria in dissemination • Checking confidentiality criteria • Objective: To check the fulfillment of safety criteria in the dissemination products of EUSTAT • Sources checked: Statistical tables and data bank (www.eustat.es) • Checking points: Geographical scope and sensitivity of variables • Results:

20. 4. Future tasks

21. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA 4.1 Towards a safe-standard microdata structure • Objective:To develop standard microdata files which will be available for the general public but with all the guarantees of confidentiality • Aspects to consider: • Type of statistics (census or sampling survey) • Hierarchical structure of the data (i.e.: families and individuals) • Geographical indicators included • Identifying variables and possible combinations (identifying keys) • Level of detail (number of categories) of the variables included • Sensitive variables included (if any) • Risk indicator • Disclosure control methods to be applied • Information loss measure (Utility measure)

22. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA 4.2 On-site access facility • Objective: To provide users (mainly researchers) with an ‘in-situ’ workstation where microdata could be accessed under specific conditions. • Aspects to consider: • Type of user (general public, researcher,…) • Purpose of the data access • Conditions of data access (confidentiality agreements, limited access, passwords,…) • Physical aspects (location, number of computers,…)

23. EUSKAL ESTATISTIKA ERAKUNDEA INSTITUTO VASCO DE ESTADÍSTICA 5. Conclusions • EUSTAT has been working on the development of standard criteria to protect statistical products: microdata and tabular data • The establishment of these confidentiality rules has been a hard process, and the discussion about what should be considered as identifiable or sensitive is still ongoing • These criteria should be updated continuously, reflecting changes in the legal framework, in the technological environment and in social reality

24. More information in… www.eustat.es Thanks for your attention! Joint UNECE/Eurostat work session on statistical data confidentiality Manchester, 17-19 December 2007