Census 2011 – A Question of Confidentiality

Statistical Disclosure control for the 2011 Census

Carole AbrahamsONS Methodology

BSPS – York, September 2011

Overview

• Brief introduction to SDC

• Census outputs & confidentiality

• Record swapping

• Data utility

• 2001 vs 2011

• Communal Establishments

• Further work

Introduction to SDC (1) - What is disclosure risk?

There is a disclosure risk when information is published that could allow an intruder to indicate the identity or particulars of:

• an individual

• a household or family

• a business

• or another statistical unit

4

• Identification disclosure• Attribute disclosure (AD)• Group disclosure

Introduction to SDC (2) - Examples of disclosure risk

Introduction to SDC (3) - Statistical Disclosure Control

Statistical Disclosure Control (SDC) involves

either: • introducing sufficient ambiguity/damage into, or

reducing level of detail, of published statistics, so that the risk of disclosing confidential information is reduced to an acceptable level

and/or:• controlling access to data

Census outputs and confidentiality

• Disclosure control of Census outputs required by law

• Pledge on Census forms• Visible variables

– use to identify individual/family/household– find out something new about them– Data Environment Analysis Service (DEAS)

• Sensitive variables– defined by DPA

Risk – Utility balance

Disclosure Risk:

Information about

confidential units

Data Utility: Information about legitimate items

Original Data

No dataReleased

Data

Maximum Tolerable Risk

High

High

Low

SDC for Census 2001

• Random record swapping

• Lack of harmonisation and late changes to agreed methodology

• SCA applied in E, W, NI, not in Scotland

• SCA protected individual tables, but some remaining risk through differencing

• Effect on utility at low geographies and in creating bespoke geographies

9

104 Delivery Groups (DGs) in England & Wales

• ≈ 4 LADs in a DG

• ≈ 20 MSOAs in an LAD

• ≈ 20 OAs in an MSOA

Census Geography

DG

LAD LAD

LAD LAD

MSOAMSOA

MSOA MSOA

OA OA

OAOA

SDC for Census 2011

• RsG agreement November 2006– Small cell counts as long as ‘sufficient uncertainty’– Main risk attribute disclosure

• Targeted record swapping

– Targeted to ‘risky’ records – Risk looks at particular variables, takes account of

geography– Risk scores for individuals combined to household score – Households swapped– Households swapped only as far as their risk is considered

‘high’– Imputation considered as part protection

Targeted swapping (1)

• Households− Risk score on uniqueness/rarity of small number of key

variables at different geographies

• Probability −inversely related to area imputation rate−positively related to household risk score

• Matching−look for matches only as far as is necessary−Match on household size, and other variables if possible

Targeted swapping – an example of how it works (1)

Risky within OA

Risky within MSOA

Risky within LA

Swap with h’hold in another OA in MSOA

Swap with h’hold in another MSOA in LA

Swap with h’hold in another LA within delivery group

Household is in area that has high response rate, therefore low imputation.

So area has higher than average swapping rate

Targeted swapping – an example of how it works (2)

Household found to be risky within OA and is selected for swapping. Only swapped between OAs in the same MSOA.

Households are matched on:

Adults = 2

Children = 1

Pets = 2

Swapping & Sufficient uncertainty

• Level of swapping in an area determined by level of non-response / imputation

• Swapping lower where more imputed records

• Sufficient uncertainty has been assessed by two factors:– Percentage of real attribute disclosures (ADs)

protected by imputation & swapping– Percentage of apparent ADs created

Effect of targeted swapping on data utility

LLTI by OA LLTI by MSOA

• Typical effect of swapping on numbers of people with LLTI

• Based on 2001 data

• Utility higher at MSOA than at OA

Summary of SDC methodology

• Main effect on utility will be for small cells at low level geographies

• Tables will be consistent and additive

• Will use minimum average cell size

• All univariate residence-based tables at OA publishable

• There will be no small cell adjustment

• Tables will contain apparent small cells and apparent ADs, but an intruder can’t find out something about an individual case with a “high degree of confidence”

17

Communal establishmentsFor client residents:

For staff residents:

Further work

• Minority population outputs.

• Flow data

• Microdata

• Workplace tables

• Commissioned tables

• Contact: SDC queries@ons.gov.uk