IASSIST Conference: Tampere, May 26-29, 2009

Introduction

• Newest major addition to SDA (3.3) is Disclosure Protection
• How to make sensitive data public
• Without compromising respondent confidentiality

A. Rules Applied AFTER an analysis is run

1. Problem of small cells -- only a few cases in a cell

• Table showing frequency of cocaine use

• Cocaine use by age and military service
  Note: Only 3 cases in the first cell

• It might be possible to identify the respondents
  Use selection filters and other variables
  Even a large dataset can be examined like this

• Inadequate solution: suppress the small cell

  Simple subtraction can be done to figure out the N of cases in the missing cell.

• Various algorithms can be used to modify the remaining cells, in order to hide the missing N of cases, but they have problems:
  • Very complicated
  • No agreement on the best method
  • Probably not worth the trouble

• Easier just to suppress the whole table -- SDA solution

2. Tables with low AVERAGE cell size

• Example of a table with several relatively small cells

• Such a table can also be suppressed
  even though no single cell is below the single cell threshold.

• SDA looks at both the MEAN and the MEDIAN number of cases in the table cells
  (excluding from the calculation cells with no cases at all).

3. Other rules that can be applied after an analysis is run

• Too many independent variables in a regression request

• Almost all cases in an analysis have the same senstive characteristic
  (e.g., they live in the same Postal Code area).

  SDA can monitor such a variable even if it is not part of the requested analysis.

• Show only weighted N's -- no unweighted N's

B. Rules that prevent an analysis from even running - to anticipate problems

• Specific variables that should not be used in an analysis.
  (e.g., CASEID or POSTCODE)

  These variables cannot be used in RECODE or COMPUTE statements either.

• COMBINATIONS of variables that should not be used in the same analysis because they will almost certainly result in cells that are too small.
  (e.g., AGE and OCCUPATION in the same table)

  These variables cannot be used in RECODE or COMPUTE statements either.

• Too many SELECTION FILTERS
  SDA can limit the user to 1 or 2 or some other number.

• Using a control variable in a table
  (e.g., run a separate table for each occupation code)

• Avoiding procedures that output case-level data
  • The LISTCASE procedure
  • The SUBSET procedure

C. How a data library sets Disclosure Rules in SDA

• Create a simple text file with Disclosure Specifications.

• Put it in a certain place in the SDA structure for a dataset.

• ALL of the SDA programs will follow the specified rules.

• See the Disclosure manual page at http://sda.berkeley.edu/man33h/disclosure.htm for all the details.

• This summary page is currently located at: http://sda.berkeley.edu/present/iassist09
• The SDA manual page describing how to set up disclosure rules is at: http://sda.berkeley.edu/man33h/disclosure.htm
• The SDA home page is at: http://sda.berkeley.edu
• For information on obtaining SDA software, go to: http://sda.berkeley.edu/info/GetSDA.html