Estimation of the Probit Model From Anonymized Micro Data

 Gerd Ronning and Martin RosemannUniversität Tübingen & IAW Tübingen

UNECE Work Session on Statistical Data Confidentiality, Geneva,

9 – 11 November 2005

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

2

Agenda:

• The German anonymization project (see also the earlier presentation by Rainer Lenz)

• Main Results• Estimation of the probit model from anonymized

data

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

3

Overview• German project run jointly by the German Statistical Office

and Institute for Applied Economic Research. • German law allows the Statistical Office to provide

scientific researchers with data which are only moderately anonymized

• These data are said to satisfy “factual anonymization” (in German “faktische Anonymisierung”).

• They can be seen as scientific-use files. • The main emphasis of the project is on data from

enterprises for which confidentiality is a more sensitive topic than for data from households

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

4

Two objectives of anonymization

• Anonymization of data has to satisfy two objectives which are opposing each other: – (a) minimization of risk of disclosure, – (b) minimization of loss of data quality.

• A compromise has to be reached. • However, factual anonymization has to

guarantueed before we may consider the quality of these data.

• Alternative strategies may be possible and some may lead to a smaller loss of data quality.

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

5

The business micro data used in the project

• Kostenstrukturerhebung im Verarbeitenden Gewerbe und Bergbau (1999) (cost structure),

• Umsatzsteuerstatistik (2000) (value added tax)• Einzelhandelsstatistik (1999) (retail business)

Only partly related:• IAB-Betriebspanel (IAB panel of firms)

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

6

Different masking procedures

• We compare different masking procedures, in particular microaggregation and “addition” of noise (also in a multiplicative manner).

• For discrete variables we consider masking by post-randomization.

• Other masking procedures, in particular data swapping, have been found to imply too much distortion with respect to data quality.

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

7

„Corrected“ estimation under anonymization

• We also consider the possibility of correcting the estimation procedures in linear and nonlinear models in such a way that consistent (unbiased) estimators are derived.

• Examples given below.

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

8

Two different strategies of anonymization

• „Information reducing procedures“– Reduction with respect to observational units– Reduction with respect to certain variables– Reduction or coarsening of possible outcomes

• „Data modifying procedures“– Microaggregation– Noise addition– Post randomization (PRAM)

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

9

Emphasis of project on „data modifying procedures“

• ....employing, however, some „information reducing procedures“ at the outset.

• For example, regional information was deleted with exception of „west“ and „east“ of Germany.

• „data modifying procedures“ have the advantage that impact on estimation of stochastic models can be formally analyzed.

• For example

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

10

Examples of „corrected“ estimation

• For example, in the linear regression model microaggregation can easily be handled by specifying an adequate covariance structure.

• In case of addition of noise we have ‘errors in variables’ which ask for instrumental variable estimation.

• Alternatively we may use the “SIMEX” approach. • Post-randomization of a binary dependent

variable leads to a generalization of the probit model which allows consistent estimation.

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

11

Problems of „Corrected“ estimation

• Effect of anonymization of a variable depends....• ...on the procedure ...• ...and whether we use the variable as regressor

or as regressand!• For example, if we post randomize a binary

variable, it can be used as dependent variable in the probit model or as a „dummy variable“ in the linear regression model.

• The first case will be discussed below in more detail.

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

12

The probit model

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

13

(Symmetric) Post randomization of binary variable

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

14

ML Estimation of the probit model under PRAM (1)

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

15

ML Estimation of the probit model under PRAM (2)

• Consistent Estimation of probit model under PRAM is possible if right hand regressors are left unprotected.

• As we will see, it is also possible to estimate consistently the probit model if only right hand variables are protected by addition of noise.

• However, no satisfactory procedure has been found so far for the most relevant case that both the dependent and the independent variables had been anonymized.

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

16

Addition of noise (in the linear model)

• Additive error

• Multiplicative error

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

17

Estimation under (additive) noise of regressor

• Inconsistency of estimate:

• Estimate from SIMEX procedure (adding error by purpose):

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

18

Extrapolation in the SIMEX procedure

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

19

Report on recent work from estimating the probit model from anonymized micro data (1)

• ML estimation of generalized probit model combined with SIMEX procedure did not work satisfactorily even in the case of no post randomizaion !

• However estimation of the generalized linear model for the special case representing the probit model gave good results for the case „noise addition but no PRAM“.

• STATA SIMEX Procedure !

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

20

Report on recent work from estimating the probit model from anonymized micro data (2)

• So far we have no adequate estimation procedure for the case that both the dependent variable is masked by PRAM and the regressor variable(s) is (are) protected by noise addition.

• Note that we consider here a (frequently used) nonlinear model.

• However for linear models correcting estimation procedures seem to work fine.

• See the research report !

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

21

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

22

Concluding Remarks (Importance of the project) :

• For the first time simultaneous consideration of confidentiality issues and data quality aspects as seen from user‘s side..

• For the first time consideration of impacts of anonymization on statistical inference.

• Use of real data sets from German statistical office.• Use of modern matching algorithms in simulating

scenarios for disclosure. See earlier presentation by Rainer Lenz !

• Use of commercial data bases for simulating external knowledge.

UNECE Work Session on Statistical Data Confidentiality, Geneva, 9 – 11 November 2005

23

Future Research

• So far only cross-section data.• Extension to the case of panel data.• Multiple imputation as a masking procedure.• A project will start very soon !