Providing and Protecting Microdata

  • George T. DuncanEmail author
  • Mark Elliot
  • Juan-José Salazar-González
Part of the Statistics for Social and Behavioral Sciences book series (SSBS)


A microdata file is a compilation of data records. Each record contains values of attributes about a single unit—say a person with the attributes of their height, attitude toward minimum wage laws, cell-phone usage, and diastolic blood pressure. Microdata are special. Expanding Access to Research Data: Reconciling Risks and Opportunities (National Research Council, 2005) recognizes both the enthusiasm for the research potential of microdata and the trepidation about the risk microdata pose to confidentiality. In this chapter we help reconcile the inevitable tension of both protecting and providing microdata. We lay out the principles of microdata confidentiality and identify ways of improving DSO practice.


Synthetic Data Population Unit Disclosure Risk National Statistical Office Restricted Data 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


  1. Abowd, J.M., Woodcock, S.D.: Disclosure limitation in longitudinal linked data. In: Doyle, P. et al. (eds.) Confidentiality, Disclosure, and Data Access, pp. 135–166. North Holland, Amsterdam (2002)Google Scholar
  2. Abowd, J.M., Woodcock, S.D.: Multiply-imputing confidential characteristics and file links in longitudinal linked data. In: Domingo-Ferrer, J., Torra, V. (eds.) Privacy in Statistical Databases 2004, pp. 290–297. Springer, New York, NY (2004)Google Scholar
  3. Agrawal, R., Srikant, R.: Privacy-preserving data mining. Proceedings of the 2000 ACM SIGMOD on Management of Data, Dallas, TX, 15–18 May 2000Google Scholar
  4. Bayardo, R.J., Agrawal, R.: Data privacy through optimal K-anonymization. Proceedings of the 21st International Conference on Data Engineering, 2005. ICDE 2005. Tokyo (2005)Google Scholar
  5. Béland, Y.: Release of public use microdata files for NPHS? mission…partially Accomplished! In: Proceedings of the Survey Research Methods Section, pp. 404–409. American Statistical Association, Baltimore (1999)Google Scholar
  6. Bernardinelli, L., Montomoli, C.: Empirical Bayes versus fully Bayesian analysis of geographical variation in disease risk. Stat. Med. 11, 983–1007 (1992)CrossRefGoogle Scholar
  7. Besag, J.: Spatial interaction and the statistical analysis of lattice systems. J. R. Stat. Soc. Ser. B 36, 192–236 (1974)zbMATHMathSciNetGoogle Scholar
  8. Besag, J., York, J., Mollié, A.: Bayesian image restoration, with two applications in spatial statistics. Ann. Inst. Stat. Math. 43, 1–59 (1991)CrossRefzbMATHGoogle Scholar
  9. Bethlehem, J.G., Keller, W.J., Pannekoek, J.: Disclosure control of microdata. J. Am. Stat. Assoc. 85, 38–45 (1990)CrossRefGoogle Scholar
  10. Blien, U., Wirth, H., Müller, M.: Disclosure risk for microdata stemming from official statistics. Stat. Neerl. 46, 69–82 (1992)CrossRefGoogle Scholar
  11. Brand, R.: Microdata protection through noise addition. In: Domingo-Ferrer, J. (ed.) Inference Control in Statistical Databases. Lecture Notes in Computer Science, vol. 2316, pp. 97–116. Springer, Berlin, Heidelberg (2002a)Google Scholar
  12. Carter, R., Boudreau, J.-R., Briggs, M.: Analysis of the risk of disclosure for census microdata. Statistics Canada Working Paper, Statistics Canada, Ottawa, ON 1991Google Scholar
  13. Conway, R., Strip, D.: Selective partial access to a database. Proceedings of the ACM Annual Conference, New York, NY 1976Google Scholar
  14. Dale, A.: Confidentiality of official statistics: an excuse for privacy. In: Dorling, D., Simpson, S. (eds.) Statistics in Society, pp. 29–37. Arnold, London (1998)Google Scholar
  15. Dalenius, T.: Controlling invasion of privacy in surveys. Department of Development and Research, Statistics, Sweden (1988)Google Scholar
  16. Dalenius, T., Reiss, S.P.: Data-swapping: a technique for disclosure control (extended abstract). American Statistical Association, Proceedings of the Section on Survey Research Methods, Washington, DC, pp. 191–194 1978Google Scholar
  17. Dalenius, T., Reiss, S.P.: Data-swapping: a technique for disclosure control. J. Stat. Plann. Inference 6, 73–85 (1982)CrossRefzbMATHMathSciNetGoogle Scholar
  18. Dandekar, R., Domingo-Ferrer, J., Sebé, F.: LHS-based hybrid microdata vs. rank swapping and microaggregation for numeric microdata protection. In: Domingo-Ferrer, J. (ed.) Inference Control in Statistical Databases. Lecture Notes in Computer Science, vol. 2316, pp. 153–162. Springer, Berlin, Heidelberg (2002)Google Scholar
  19. De Waal, T., Willenborg, L.C.R.J.: A view on statistical disclosure for microdata. Surv. Methodol. 22(1), 95–103 (1996)Google Scholar
  20. Defays, D., Anwar, M.N.: Masking microdata using micro-aggregation. J. Official Stat. 14, 449–461 (1998)Google Scholar
  21. Defays, D., Nanopoulos, P.: Panels of enterprises and confidentiality: the small aggregates method. Proceedings of 1992 Symposium on Design and Analysis of Longitudinal Surveys, pp. 195–204. Statistics Canada, Ottawa, ON (1993)Google Scholar
  22. DeWaal, A.G., Willenborg, L.C.R.J.: Global recodings and local suppressions in microdata sets. Proceedings of Statistics Canada Symposium’ 95, pp. 121–132. Statistics Canada, Ottawa, ON (1995)Google Scholar
  23. DeWaal, A.G., Willenborg, L.C.R.J.: Information loss through global recoding and local suppression. Netherlands Official Stat. 14, 17–20 (1999). Special issue on SDCGoogle Scholar
  24. Domingo-Ferrer, J.: On the complexity of micro aggregation. Paper presented at the UNECE Workshop on Statistical Data Editing, Skopje, Macedonia, May 2001Google Scholar
  25. Domingo-Ferrer, J., Mateo-Sanz, J.M.: Practical data-oriented microaggregation for statistical disclosure control. IEEE Trans. Knowl. Data Eng. 14(1), 189–201 (2002)CrossRefGoogle Scholar
  26. Domingo-Ferrer, J., Mateo-Sanz, J.M., Oganian, A., Torres, A.: On the security of microaggregation with individual ranking: analytical attacks. Int. J. Uncertainty Fuzziness Knowl.-Based Syst. 10(5), 477–492 (2002)CrossRefzbMATHMathSciNetGoogle Scholar
  27. Domingo-Ferrer, J., Sebé, F., Castella, J.: On the security of noise addition for privacy in statistical databases. In: Domingo-Ferrer, J., Torra, V. (eds.) Privacy in Statistical Databases. Lecture Notes in Computer Science, vol. 3050, pp. 149–161. Springer, Berlin, Heidelberg (2004)CrossRefGoogle Scholar
  28. Domingo-Ferrer, J., Torra, V.: A quantitative comparison of disclosure control methods for microdata. In: Zayatz, L., Doyle, P., Theeuwes, J., Lane, J. (eds.) Confidentiality, Disclosure and Data Access: Theory and Practical Applications for Statistical Agencies, pp. 111–133. North-Holland, Amsterdam (2001)Google Scholar
  29. Domingo-Ferrer, J., Torra, V.: Disclosure risk assessment in statistical microdata protection via advanced record linkage. Stat. Comput. 13, 343–354 (2003)CrossRefMathSciNetGoogle Scholar
  30. Domingo-Ferrer, J., Torra, V.: Ordinal, continuous and heterogeneous k-anonymity through microaggregation. Data Mining Knowl. Discov. 11(2), 195–212 (2005)CrossRefMathSciNetGoogle Scholar
  31. Doyle, P., Lane, J., Theeuwes, J., Zayatz, L.: Confidentiality, Disclosure and Data Access: Theory and Practical Applications for Statistical Agencies. Elsevier Science, Amsterdam (2001)Google Scholar
  32. Duncan, G.T., Fienberg, S.E.: Obtaining information while preserving privacy: a Markov perturbation method for tabular data. Eurostat. Proceedings of Statistical Data Protection '98, Lisbon, pp. 351–362 (1999)Google Scholar
  33. Duncan, G.T., Keller-McNulty, S.A., Stokes, S.L.: Disclosure risk vs. data utility: the R-U confidentiality map. Technical report LA-UR-01-6428, Los Alamos National Laboratory, Los Alamos, NM 2001Google Scholar
  34. Duncan, G.T., Lambert, D.: Disclosure-limited data dissemination (with discussion). J. Am. Stat. Assoc. 81(393), 10–28 (1986)CrossRefGoogle Scholar
  35. Duncan, G.T., Lambert, D.: The risk of disclosure for microdata. J. Bus. Econ. Stat. 7, 207–217 (1989)CrossRefGoogle Scholar
  36. Duncan, G.T., Mukherjee, S.: Microdata disclosure limitation in statistical databases: query size and random sample query control. Proceedings of the 1991 IEEE Computer Society Symposium on Research in Security and Privacy, Oakland, CA, pp. 278–287 (1991)Google Scholar
  37. Duncan, G.T., Mukherjee, S.: Optimal disclosure limitation strategy in statistical databases: deterring tracker attacks through additive noise. J. Am. Stat. Assoc. 95, 720–729 (2000)CrossRefGoogle Scholar
  38. Duncan, G.T., Pearson, R.W.: Enhancing access to microdata while protecting confidentiality: prospects for the future (with discussion). Stat. Sci. 6, 219–239 (1991)CrossRefGoogle Scholar
  39. Duncan, G., Pearson, R., Jabine, T.: The pursuit of knowledge and the protection of privacy: conflicts between access to and confidentiality of surveys of U.S. doctorates. Items (Social Science Research Council), pp. 65–70 September 1989Google Scholar
  40. Elliot, M.J.: Data intrusion simulation: advances and a vision for the future of disclosure control. Stat. J. United Nations 17, 1–9 (2001)Google Scholar
  41. Elliot, M.J., Dale, A.: Scenarios of attack: a data intruder’s perspective on statistical disclosure risk. Netherlands Official Stat. 14, 6–10 (1999)Google Scholar
  42. Elliot, M.J., Skinner, C.J., Dale, A.: Special uniques, random uniques and sticky populations: some counterintuitive effects of geographical detail on disclosure risk. Res. Official Stat. 1(2), 53–68 (1998)Google Scholar
  43. Federal Committee on Statistical Methodology: Statistical Policy Working Paper 22: Report on Statistical Disclosure Limitation Methodology, U.S. Office of Management and Budget, Washington, DC 2005Google Scholar
  44. Fellegi, I.P.: On the question of statistical confidentiality. J. Am. Stat. Assoc. 67, 7–18 (1972)CrossRefzbMATHGoogle Scholar
  45. Fellegi, I.P., Sunter, A.B.: A theory for record linkage. J. Am. Stat. Assoc. 64, 1183–1210 (1969)CrossRefGoogle Scholar
  46. Fienberg, S.E.: Conflicts between the needs for access to statistical information and demands for confidentiality. J. Official Stat. 10, 115–132 (1994)Google Scholar
  47. Fienberg, S.E.: Confidentiality and disclosure limitation methodology: challenges for national statistics and statistical research. Commissioned by Committee on National Statistics of the National Academy of Sciences (1997)Google Scholar
  48. Fienberg, S.E., McIntyre, J.: Data swapping: variations on a theme by Dalenius and Reiss. In: Domingo-Ferrer, J., Torra, V. (eds.) PSD 2004. Lecture Notes in Computer Science, vol. 3050, pp. 14–29. Springer, Berlin, Heidelberg (2004)Google Scholar
  49. Fienberg, S.E., Makov, U.E., Sanil, A.P.: A Bayesian approach to data disclosure: optimal intruder behavior for continuous data. J. Official Stat. 14, 75–89 (1997)Google Scholar
  50. Fienberg, S.E., Makov, U.E., Steel, R.J.: Disclosure limitation using perturbation and related methods for categorical data. J. Official Stat. 14, 485–502 (1998)Google Scholar
  51. Fienberg, S.E., Steele, R.J., Makov, U.E.: Statistical notions of data disclosure avoidance and their relationship to traditional statistical methodology: data swapping and loglinear models. Proceedings of Bureau of the Census 1996 Annual Research Conference, US Bureau of the Census, Washington, DC, pp. 87–105 1996Google Scholar
  52. Foster, L., Haltiwanger, J., Krizan, C.J.: Aggregate productivity growth: lessons from microeconomic evidence. In: Hulten, C.R., Dean, E.R., Harper, M.J. (eds.) New Developments in Productivity Analysis, pp. 303–363. University of Chicago Press, Chicago, IL (2001)Google Scholar
  53. Fuller, W.A.: Masking procedures for microdata disclosure limitation. J. Official Stat. 9, 383–406 (1993)Google Scholar
  54. Goldstein, H.: Multilevel Models in Educational and Social Research. Charles Griffin, London (1987)Google Scholar
  55. Gomatam, S., Larsen, M.D.: Record linkage and counterterrorism. Chance 17(1), 25–29 (2004)MathSciNetGoogle Scholar
  56. Greenburg, B.V., Voshell, L.: The geographic component of disclosure risk for microdata. SRD Research report Census/SRD/RR-90/13, Bureau of the Census, Washington, DC 1990Google Scholar
  57. Griffin, R.A., Navarro, A., Flores-Baez, L.: Disclosure avoidance for the 1990 Census. Proceedings of the Section on Survey Research Methods, American Statistical Association, Alexandria, VA, pp. 516–521 (1989)Google Scholar
  58. Hansen, S.L., Mukherjee, S.: A polynomial algorithm for optimal univariate microaggregation. IEEE Trans. Knowl. Data Eng. 15(4), 1043–1044 (2003)CrossRefGoogle Scholar
  59. Jabine, T.B.: Procedures for restricted data access. J. Official Stat. 9(2), 537–589 (1993a)Google Scholar
  60. Jabine, T.B.: Statistical disclosure limitation practices of United States statistical agencies. J. Official Stat. 9(2), 427–454 (1993b)Google Scholar
  61. Kennickell, A.B.: Multiple imputation and disclosure control: the case of the 1995 survey of consumer finances. In: Alvey, W., Jamerson, B., (eds.) Record Linkage Techniques 1997, pp. 248–267. National Academy Press, Washington, DC. (1999)
  62. Kim, J.J., Winkler, W.E.: Masking microdata files. Proceedings of the Section on Survey Research Methods, American Statistical Association, Alexandria, VA, pp. 114–119 (1995)Google Scholar
  63. Kim, J.J., Winkler, W.E.: Multiplicative noise for masking continuous data. Proceedings of the Section on Survey Research Methods, American Statistical Association, Alexandria, VA 2001Google Scholar
  64. Lane, J.: Key Issues in Confidentiality Research: Results of an NSF Workshop. (2003)
  65. Laszlo, M., Mukherjee, S.: Minimum spanning tree partitioning algorithm for microaggregation. IEEE Trans. Knowl. Data Eng. 17(7), 902–911 (2005)CrossRefGoogle Scholar
  66. Lee, J., McClellan, M.B., Skinner, J.S.: The distributional effects of medicare (January 1999). NBER Working Paper No. W6910 (1999)Google Scholar
  67. Little, R.J.A.: Statistical analysis of masked data. J. Official Stat. 9(2), 407–426 (1993)Google Scholar
  68. Machanavajjhala, A., Kifer, D., JAbowd, J., Gehrke, J., Vilhuber, L.: Privacy: from theory to practice on the map. ICDE Conference 2008. Cancun, Mexico, April 2008. (2008)
  69. Mateo-Sanz, J.M., Domingo-Ferrer, J.: A method for data-oriented multivariate microaggregation. In: Domingo-Ferrer, J. (ed.) Statistical Data Protection, pp. 89–99. Office for Official Publications of the European Communities, Luxemburg (1999)Google Scholar
  70. Mateo-Sanz, J.M., Sebé, F., Domingo-Ferrer, J.: Outlier protection in continuous microdata masking. In: Domingo-Ferrer, J., Torra, V. (eds.) Privacy in Statistical Databases. Lecture Notes in Computer Science, vol. 3050, pp. 201–215. Springer, Berlin, Heidelberg (2004)CrossRefGoogle Scholar
  71. McCaa, R., Ruggles, S.: The census in global perspective and the coming microdata revolution. Scand. Populat. Stud. 17, 7–30 (2002)Google Scholar
  72. McMillen, M.: Data access: national center for education statistics, of significance. J. Assoc. Public Data Users 2, 1 (2001)Google Scholar
  73. Mera, R.N.: Matrix masking methods which preserve moments. American Statistical Association Proceedings Anaheim (1997)
  74. Mokken, R.J., Kooiman, P., Pannekoek, J., Willenborg, L.C.R.J.: Disclosure risks for microdata. Stat. Neerl. 46, 49–67 (1992)CrossRefGoogle Scholar
  75. Mollié, A.: Bayesian mapping of disease. In: Gilks, W.R., Richardson, S., Spiegelhalter, D.J. (eds.) Markov Chain Monte Carlo in Practice, pp. 359–379. Chapman and Hall, London (1996)Google Scholar
  76. Moore, R.: Controlled data swapping techniques for masking public use data sets. U.S. Bureau of the Census, Statistical Research Division Report rr96/04. Available at Accessed Jan 21, 2011 (1996)
  77. Muralidhar, K., Parsa, R., Sarathy, R.: A general additive data perturbation method for database security. Manage. Sci. 45(10), 1399–1415 (1999)CrossRefGoogle Scholar
  78. National Research Council: Expanding access to research data: reconciling risks and opportunities. Panel on Data Access for Research Purposes, Committee on National Statistics, Division of Behavioral and Social Sciences and Education. The National Academies Press, Washington, DC (2005)Google Scholar
  79. Navarro, A., Flores-Baez, L., Thompson, J.: Results of data switching simulation. Presented at the Spring meeting of the American Statistical Association and Population Statistics Census Advisory Committees, Washington, DC (1988)Google Scholar
  80. Paass, G.: Disclosure risk and disclosure avoidance for microdata. J. Bus. Econ. Stat. 6(4), 487–500 (1988)CrossRefGoogle Scholar
  81. Raghunathan, T.E.: Evaluation of inferences from multiple synthetic data sets created using semiparametric approach. Panel on Confidential Data Access for Research Purposes, Committee on National Statistics, October (2003)Google Scholar
  82. Raghunathan, T.E., Reiter, J.P., Rubin, D.R.: Multiple imputation for statistical disclosure limitation. J. Official Stat. 19, 1–16 (2003)Google Scholar
  83. Raghunathan, T.E., Rubin, D.R.: Multiple imputation for disclosure limitation. Department of Biostatistics Technical Report, University of Michigan, Dearborn, MI 2000Google Scholar
  84. Reiss, S.P.: Practical data-swapping: the first steps. ACM Trans. Database Syst. 9, 20–37 (1984)CrossRefzbMATHGoogle Scholar
  85. Reiss, S.P., Post, M.J., Dalenius, T.: Non-reversible privacy transformations. Proceedings of the ACM Symposium on Principles of Database Systems, Los Angeles, pp. 139–146 1982Google Scholar
  86. Reiter, J.P.: Satisfying disclosure restrictions with synthetic data sets. J. Official Stat. 18(4), 531–544 (2002)Google Scholar
  87. Reiter, J.P.: Inference for partially synthetic, public use microdata sets. Surv. Methodol. 29, 181–188 (2003)Google Scholar
  88. Reiter, J.P.: Significance tests for multi-component estimands from multiply-imputed, synthetic microdata. J. Stat. Plann. Inference (2004)Google Scholar
  89. Rubin, D.B.: Discussion of statistical disclosure limitation. J. Official Stat. 9(2), 461–468 (1993)Google Scholar
  90. Rubin, D.B.: Satisfying confidentiality constraints through the use of synthetic multiply-imputed microdata. J. Official Stat. 9, 461–468 (1996)Google Scholar
  91. Ruggles, S.: The public use microdata samples of the U.S. Census: research applications and privacy issues. A report of the Task Force on Census 2000, Minnesota Population Center and Inter-University Consortium for Political and Social Research Census 2000 Advisory Committee, Minnesota (2000)Google Scholar
  92. Samuels, S.J.: A Bayesian species-sampling-inspired approach to the uniques problem in microdata disclosure risk assessment. J. Official Stat. 14, 373–384 (1998)Google Scholar
  93. Sande, G.: Exact and approximate methods for data directed microaggregation in one or more dimensions. Int. J. Uncertain. Fuzziness Knowl. Based Syst. 10(5), 459–476 (2002)CrossRefzbMATHMathSciNetGoogle Scholar
  94. Sanil, A., Gomatam, S., Karr, A.: NISS WebSwap: a web-service for data swapping. J. Stat. Softw. 8(7) (2003).
  95. Schlörer, J.: Security of statistical databases: multidimensional transformation. ACM Trans. Database Syst. 6(1), 95–112 (1981)CrossRefzbMATHGoogle Scholar
  96. Skinner, C.J., Elliot, M.J.: A measure of disclosure risk for microdata. J. R. Stat. Soc. Ser. B 64(4), 855–867 (2002)CrossRefzbMATHMathSciNetGoogle Scholar
  97. Spruill, N.L.: The confidentiality and analytic usefulness of masked business microdata. Proceedings of the Section on Survey Research Methods, American Statistical Association, pp. 602–607. Alexandria, VA (1983)Google Scholar
  98. Steel, P., Sperling, J.: The Impact of Multiple Geographies and Geographic Detail on Disclosure Risk: Interactions between Census Tract and ZIP Code Tabulation Geography. U.S. Census Bureau, Washington (2001)Google Scholar
  99. Sullivan, G., Fuller, W.A.: The use of measurement error to avoid disclosure. Proceedings of the Section on Survey Research Methods, American Statistical Association, Alexandria, VA, pp. 802–807 (1989)Google Scholar
  100. Sweeney, L.: Achieving k-anonymity privacy protection using generalization and suppression. Int. J. Uncertain. Fuzziness Knowl. Based Syst. 10(5), 571–588 (2002)CrossRefzbMATHMathSciNetGoogle Scholar
  101. Takemura, A.: Local recoding and record swapping by maximum weight matching for disclosure control of microdata sets. J. Official Stat. 18(2), 275–289 (2002)Google Scholar
  102. Tendick, P.: Optimal noise addition for preserving confidentiality in multivariate data. J. Stat. Plann. Inference 27, 341–353 (1991)CrossRefzbMATHMathSciNetGoogle Scholar
  103. Tendick, P., Matloff, N.: A modified random perturbation method for database security. ACM Trans. Database Syst. 19, 47–63 (1994)CrossRefGoogle Scholar
  104. Thibaudeau, Y., Winkler, W.E.: Bayesian networks representations, generalized imputation, and synthetic microdata satisfying analytic restraints. Statistical Research Division Report RR 2002/09, Washington. (2002)
  105. Torra, V.: Microaggregation for categorical variables: a median based approach. In: Domingo-Ferrer, J., Torra, V. (eds.) Privacy in Statistical Databases. Lecture Notes in Computer Science, vol. 3050, pp. 162–174. Springer, Berlin, Heidelberg (2004)CrossRefGoogle Scholar
  106. Trottini, M.: Statistical disclosure limitation in longitudinal linked data: objectives and attributes. UNECE/Eurostat Work Session on Statistical Data Confidentiality, Geneva, Monograph in Official Statistics, Eurostat, 165–173 (2005)Google Scholar
  107. Valls, V., Torra, V., Domingo-Ferrer, J.: Aggregation methods to evaluate multiple protected versions of the same confidential data set. In: Grzegorzewski, P., Hryniewicz, O., Gil, M.A. (eds.) Soft Methods in Probability, Statistics and Data Analysis, pp. 355–362. Series Advances in Soft Computing. Physica, Heidelberg (2002)Google Scholar
  108. Willenborg, L.C.R., de Waal, T.: Statistical Disclosure Control in Practice. Lecture Notes in Statistics, vol. 111. Springer, New York, NY (1996)zbMATHGoogle Scholar
  109. Willenborg, L.C.R., de Waal, T.: Elements of Statistical Disclosure Control. Lecture Notes in Statistics, vol. 155. Springer, New York, NY (2001)CrossRefzbMATHGoogle Scholar
  110. Winkler, W.E.: Matching and record linkage. Technical report RR93/08, Statistical Research Division, U.S. Bureau of the Census, Washington, DC 1993Google Scholar
  111. Winkler, W.E.: Advanced methods for record linkage. Proceedings of the Section on Survey Research Methods, American Statistical Association, Alexandria, VA, pp. 467–472 1994Google Scholar
  112. Winkler, W.E.: Matching and record linkage. In: Cox, B.G. et al. (ed.) Business Survey Methods, pp. 355–384. Wiley, New York, NY (1995a)Google Scholar
  113. Winkler, W.E.: Re-identification methods for evaluating the confidentiality of analytically valid microdata. Res. Official Stat. 1, 87–104 (1998)Google Scholar
  114. Winkler, W.E.: Masking and re-identification methods for public-use microdata: overview and research problems. In: Domingo-Ferrer, J., Torra, V. (eds.) Privacy in Statistical Databases. Lecture Notes in Computer Science, vol. 3050, pp. 231–246. Springer, Berlin, Heidelberg. (2004a)CrossRefGoogle Scholar
  115. Wu, J., Abowd, J.: Synthetic data for administrative record applications at LEHD. Available online in the LEHD Presentations Library (2008)Google Scholar
  116. Zaslavsky, A.M., Horton, N.J.: Balancing disclosure risk against the loss of nonpublication. J. Official Stat. 14, 411–419 (1998)Google Scholar
  117. Zayatz, L.V.: Estimation of the percent of unique population elements in a microdata file using the sample. Statistical Research Division Report Series, Census/SRD/RR-91/08 Bureau of the Census, Washington, DC, pp. 674–684 1991Google Scholar
  118. Zayatz, L.V., Rowland, S.: Disclosure limitation for American FactFinder. Paper presented at the American Statistical Association Joint Statistical Meetings, Baltimore, MD, 8 August 1999Google Scholar
  119. Franconi, L., Stander, J.: Model based disclosure limitation for business microdata. The Statistician 51, 51–61 (2002)MathSciNetGoogle Scholar
  120. Franconi, L., Stander, J.: Spatial and non-spatial model-based protection for the release of business microdata.  Stat. Comput. 13, 295–305  (2003)CrossRefMathSciNetGoogle Scholar
  121. Gomatam, S., Karr, A.F., Sanil, A.P.: Data Swapping as a Decision Problem. J. Off. Stat. 21(4), 635–655 (2005)Google Scholar
  122. Zayatz, L.V., Massell, P., Steel, P.: Disclosure limitation practices and research at the U.S. Census Bureau. Special issue on statistical disclosure control. Neth. Off. Stat. 14, 26–29 (1999)Google Scholar
  123. Domingo-Ferrer, J., Mateo-Sanz, J.M., Torra. V.: Comparing SDC methods for microdata on the basis of information loss and disclosure risk. Pre-proceedings of ETK-NTTS’2001, vol. 2, pp. 807–826. Eurostat, Luxemburg (2001)Google Scholar
  124. United Nations: Managing Statistical Confidentiality & Microdata Access: Principles and Guidelines of Good Practice (2007)Google Scholar
  125. Reiter, J.P.: Releasing multiply-imputed, synthetic public use microdata: an illustration and empirical study. J. R. Stat. Soc. Ser. A 168, 185–205 (2005a)Google Scholar
  126. Reiter, J.P.: Releasing multiply imputed, synthetic public-use microdata: an illustration and empirical study. J. R. Stat. Soc. A 168, 185–205 (2005c)CrossRefzbMATHMathSciNetGoogle Scholar

Copyright information

© Springer New York 2011

Authors and Affiliations

  • George T. Duncan
    • 1
    Email author
  • Mark Elliot
    • 2
  • Juan-José Salazar-González
    • 3
  1. 1.Carnegie Mellon UniversitySanta FeUSA
  2. 2.University of ManchesterManchesterUK
  3. 3.University of La LagunaLa LagunaSpain

Personalised recommendations