Disclosure Limitation

Survey researchers in both the public and private sectors are required by strong legal and ethical considerations to protect the privacy of individuals and establishments who provide them with identifiable information. When researchers publish or share this information, they employ statistical techniques to ensure that the risk of disclosing confidential information is negligible. These techniques are often referred to as “disclosure limitation” or “disclosure avoidance” techniques, and they have been developed and implemented by various organizations for more than 40 years.

The choice of disclosure limitation methods depends on the nature of the data product planned for release. There are specific disclosure limitation methods for data released as micro-data files, frequency (count) tables, or magnitude (point estimates) tables. Online query systems may require additional disclosure limitation techniques, depending on whether the data underlying these systems are in the form of micro-data files or tables.

The first step in limiting disclosures in data products is to delete or remove from the data any personal or “direct” identifiers, such as name, street address, telephone number, or Social Security number. Once this is done, statistical disclosure limitation methods are then applied to further reduce or limit disclosure risks.

After direct identifiers are deleted from a micro-data file, there is still a possibility that the data themselves could lead to a disclosure of the individual, household, or business that provided them. Some people and some businesses have unique characteristics that would make them stand out from others. Applying micro-data disclosure limitation methods reduces the possibility of locating these unique records. Some of these methods are data reduction (delete data fields or records), data swapping, micro-aggregation, data perturbation, and imputation.

Protected micro-data produce protected tables. However, sometimes there is interest in producing tables without changing the underlying micro-data. Disclosure limitation methods for tables are applied directly to the tables. These methods include redesign of tables (collapsing rows or columns), cell suppression, controlled and random rounding, and synthetic data substitution.

The application of most disclosure limitation methods will result in some loss of information. Survey researchers should carefully select the appropriate disclosure limitation methods not only to maximize the information retained and the benefits accrued through data release but also protect confidential information from disclosure. However, when judging the risks of disclosure against the loss of information and the benefits of data release, survey researchers should recognize that there is no way to ensure complete elimination of disclosure risk short of not releasing any tables or micro-data files.