Solving problems of disclosure risk while retaining key analytic uses of publicly released microdata

MEASURES USED TO PROTECT SUBJECTS in publicly distributed microdata files often have a significant negative impact on key analytic uses of the data. For example, it may be important to analyze subpopulations within a data file such as racial minorities, yet these subjects may present the greatest disclosure risk because their records tend to stand out or be unique. Files or records that are linkable create another type of disclosure risk-common elements between two files can be used to link files with sensitive data to externally available files that disclose identity. Examples of disclosure limitation methods used to address these types of issues include blanking out data, coarsening response categories, or withholding data altogether. However, the very detail that creates the greatest risk also provides insight into differences that are of greatest interest to analysts. Restricted-use agreements that provide unaltered versions of the data may not be available, or only selectively so. The public-use version of the data is very important because it is likely to be the only one to which most researchers, policy analysts, teaching faculty, and students will ever have access. Hence, it is the version from which much of the utility of the data is extracted and often it effectively becomes the historical record of the data collection. This underscores the importance that the disclosure review c ommittee s trikes a g ood b alance b etween protection and u tility. In this paper we d escrib e our disclosure review committee's (DRC) analysis and resulting data protection plans for two national studies and one administrative data system. Three distinct disclosure limitation methods were employed, taking key uses of the data into consideration, to protect respondents while still providing statistically accurate and highly useful public-use data. The techniques include data swapping, microaggregation, and suppression of detailed geographic data. We describe the characteristics of the data sets that led to the selection of these methods, provide measures of the statistical impact, and give details of their implementations so that others may also utilize them. We briefly discuss the composition of our DRC, highlighting what we believe to be the important disciplines and experience represented by the group.