Software for tabular data protection

In order for national statistical offices to maintain the trust of the public to collect data and publish statistics of importance to society and decision-making, it is imperative that respondents (persons or establishments) be guaranteed privacy and confidentiality in return for providing requested confidential data. Consequently, for most survey and census data, disclosure limitation techniques must be applied before the data are ready for public release. For microdata, examples of methods that can be used to identify respondents include directly extracting identifying information from microdata files or indirectly identifying respondents by matching a given file with an external file. For tabular data, respondents may be identified directly from small cell counts or respondent contributions to heavily concentrated cells of magnitude data may be closely approximated by the cell value. Indirect disclosure is possible in tables through manipulation of additive tabular relationships between cell values and totals, e.g. manipulating rows and column totals in a two-dimensional table. Two-dimensional statistical tables are a staple of official statistics. This paper describes a desktop software system that for the first time implements within a single framework four standard disclosure limitation techniques for protecting tabular data in two-dimensional tables: complementary cell suppression, minimum-distance controlled rounding, unbiased controlled rounding, and controlled rounding subject to subtotals constraints, and a fifth, new method: controlled tabular adjustment, and summarizes the five methods.