Census 2011 – A Question of Confidentiality

1. Census 2011 – A Question of Confidentiality Statistical Disclosure control for the 2011 Census Carole AbrahamsONS Methodology BSPS – York, September 2011

2. Overview • Brief introduction to SDC • Census outputs & confidentiality • Record swapping • Data utility • 2001 vs 2011 • Communal Establishments • Further work

3. Introduction to SDC (1) - What is disclosure risk? There is a disclosure risk when information is published that could allow an intruder to indicate the identity or particulars of: • an individual • a household or family • a business • or another statistical unit

4. Introduction to SDC (2) - Examples of disclosure risk • Identification disclosure • Attribute disclosure (AD) • Group disclosure

5. Introduction to SDC (3) - Statistical Disclosure Control Statistical Disclosure Control (SDC) involves either: • introducing sufficient ambiguity/damage into, or reducing level of detail, of published statistics, so that the risk of disclosing confidential information is reduced to an acceptable level and/or: • controlling access to data

6. Census outputs and confidentiality • Disclosure control of Census outputs required by law • Pledge on Census forms • Visible variables • use to identify individual/family/household • find out something new about them • Data Environment Analysis Service (DEAS) • Sensitive variables • defined by DPA

7. Risk – Utility balance Disclosure Risk: Information about confidential units High Original Data Maximum Tolerable Risk Released Data No data Low Data Utility: Information about legitimate items High

8. SDC for Census 2001 • Random record swapping • Lack of harmonisation and late changes to agreed methodology • SCA applied in E, W, NI, not in Scotland • SCA protected individual tables, but some remaining risk through differencing • Effect on utility at low geographies and in creating bespoke geographies

9. Census Geography OA OA 104 Delivery Groups (DGs) in England & Wales • ≈ 4 LADs in a DG • ≈ 20 MSOAs in an LAD • ≈ 20 OAs in an MSOA MSOA MSOA OA OA LAD LAD MSOA MSOA DG LAD LAD

10. SDC for Census 2011 • RsG agreement November 2006 • Small cell counts as long as ‘sufficient uncertainty’ • Main risk attribute disclosure • Targeted record swapping • Targeted to ‘risky’ records • Risk looks at particular variables, takes account of geography • Risk scores for individuals combined to household score • Households swapped • Households swapped only as far as their risk is considered ‘high’ • Imputation considered as part protection

11. Targeted swapping (1) • Households • Risk score on uniqueness/rarity of small number of key variables at different geographies • Probability • inversely related to area imputation rate • positively related to household risk score • Matching • look for matches only as far as is necessary • Match on household size, and other variables if possible

12. Targeted swapping – an example of how it works (1) Household is in area that has high response rate, therefore low imputation. So area has higher than average swapping rate Risky within OA Swap with h’hold in another OA in MSOA Risky within MSOA Swap with h’hold in anotherMSOAin LA Swap with h’hold in another LA within delivery group Risky within LA

13. Targeted swapping – an example of how it works (2) Households are matched on: Adults = 2 Children = 1 Pets = 2 Household found to be risky within OA and is selected for swapping. Only swapped between OAs in the same MSOA.

14. Swapping & Sufficient uncertainty • Level of swapping in an area determined by level of non-response / imputation • Swapping lower where more imputed records • Sufficient uncertainty has been assessed by two factors: • Percentage of real attribute disclosures (ADs) protected by imputation & swapping • Percentage of apparent ADs created

15. Effect of targeted swapping on data utility LLTI by OA LLTI by MSOA • Typical effect of swapping on numbers of people with LLTI • Based on 2001 data • Utility higher at MSOA than at OA

16. Summary of SDC methodology • Main effect on utility will be for small cells at low level geographies • Tables will be consistent and additive • Will use minimum average cell size • All univariate residence-based tables at OA publishable • There will be no small cell adjustment • Tables will contain apparent small cells and apparent ADs, but an intruder can’t find out something about an individual case with a “high degree of confidence”

17. Communal establishments For client residents: For staff residents:

18. Further work • Minority population outputs. • Flow data • Microdata • Workplace tables • Commissioned tables • Contact: SDC queries@ons.gov.uk