Statistical Confidentiality Measures by Institut de la statistique du Québec

1. The Institut de la statistique du Québec’s Approach to the Confidentiality of Microdata Files and Tabular Data Jimmy Baulne, Éric Gagnon and Lyne Des Groseilliers Institut de la statistique du Québec Work Session on Statistical Data Confidentiality Geneva, 9-11 November 2005

2. Overview • Introduction • Approach to the confidentiality of microdata files • Approach to the confidentiality of tabular data • Conclusion

3. Introduction • Institut de la statistique du Québec (ISQ): • the official statistical agency of the Quebec government; • ISQ’s mission: • providing reliable and objective statistical information on all aspects of Quebec society; • Approach for dissemination of its products: • ensuring flexibility in making these products accessible; • protecting their confidentiality.

4. Approach to the confidentiality of microdata files Three disclosure risk control measures : • Statistical measures: statistical disclosure control (SDC rules): • A region that can be distinguished in the microdata files must contain a minimum number of inhabitants; • Local suppression and global recoding are the main methods applied to avoid the publication of rare combinations of values of indirect identifiers. • Legal and administrative requirements: • Users must sign an agreement with the Institute, agreeing to protect the confidentiality of the data provided.

5. Approach to the confidentiality of microdata files • Physical and computer security measures: • Access to the copy of the microdata file or its subproducts must be controlled and restricted to authorized individuals; • The file must be kept in a secure location and encrypted; • Paper copies must be kept in a secure location; • Etc. • SDC rules + Other rules = Adequate risk control

6. Approach to the confidentiality of microdata files +++ : most strict + : least strict

7. Approach to the confidentiality of tabular data • Covers all tabular data produced from a file belonging to the Institute and disseminated by an Institute employee or a researcher. • The approach is based on: • The kind of microdata file used • The kind of data in the table • Who wants to disseminate the table • The variables used to produce the table

8. Approach for tabular data 3 procedures 1 procedure 1 procedure

9. Approach for tabular data 3 procedures 1 procedure Non-masked file (RDC) Institute employee SUMF (RDC) Institute employee

10. Delicate and strategic variables More strict SDC rules will be applied on tables with: • Social surveys • Delicate variables • Ethnicity and small geographic classification • Business surveys • Strategic variables

11. SDC rules for tabular data • Risk is identified on the basis of: • Low frequency cells • Zero cells (0%) and full cells (100%) • Sensitivity measures for magnitude data (mostly dominance rule) • Risk limitation is made by: • Table redesign • Local suppression (primary and secondary) • Prohibiting regional dissemination of tables (in certain cases)

12. Conclusion • The approaches on confidentiality of microdata and tabular data allow the Institute to fulfil its obligation to protect the confidentiality of the information it releases, while offering researchers access to data with satisfactory analytical potential. • We used the Argus twins (Tau and Mu) in some projects to protect tables and microdata files. Merci