Search

ABSTRACT National Statistical Agencies and other data custodian agencies hold a wealth of data regarding individuals and organizations, collected from censuses, surveys and administrative sources. In many cases, these data are made available to external researchers, for the investigation of questions of social and economic importance. To enhance access to this information, several national statistical agencies are developing remote analysis systems (RAS) designed to accept queries from a researcher, run them on data held in a secure environment, and then return the results. RAS prevent a researcher from accessing the underlying data, and most rely on manual checking to ensure the responses have acceptably low disclosure risk. However, the need for scalability and consistency will increasingly require automated methods. We propose a RAS output confidentialization procedure based on statistical bootstrapping that automates disclosure control while achieving a provably good balance between disclosure risk and usefulness of the responses. The bootstrap masking mechanism is easy to implement for most statistical queries, yet the characteristics of the bootstrap distribution assure us that it is also effective in providing both useful responses and low disclosure risk. Interestingly, our proposed bootstrap masking mechanism represents an ideal application of Efron's bootstrap-one that takes advantage of all the theoretical properties of the bootstrap, without ever having to construct the bootstrap distribution. [ABSTRACT FROM AUTHOR]

This paper presents a summary of the current state of research on reducing the risk of disclosure related to what may be called 'non-traditional' outputs for statistical agencies. Whereas traditional outputs include frequency tables, magnitude tables and public use microdata files, non-traditional outputs include outputs associated with user-defined exploratory data analysis and statistical modelling offered through a remote analysis system. In remote analysis, a system accepts a query from an analyst, runs it on data held in a secure environment, and then returns the results to the analyst. There is a considerable current interest in fully automated remote analysis systems, because these have the potential to enable agencies to respond to growing researcher demand for more and more detailed data. In practice, a range of protective measures is most effective in remote analysis, and the choice of this range depends heavily on the context including the regulatory environment, the dataset itself, and the purpose of the access. This paper provides a summary of known attack methods on remote analysis system outputs, focussing on exploratory data analysis and linear regression. The paper also summarizes the associated suggested protective measures designed to prevent disclosures and thwart attacks in fully automated remote analysis systems. Some commentary on the attacks and measures is provided. [ABSTRACT FROM AUTHOR]

The article provides information on various issues that relates to maintenance of confidentiality while collection, dissemination and publication of statistical data by government agencies. It refers to several statistical models that should be followed by agencies to limit disclosure of statistical data. It also highlights importance of analyzing disclosure risk assessment for agencies dealing with statistical data.

Background: The Centre for Data Linkage (CDL) has been established to enable national and cross-jurisdictional health-related research in Australia. It has been funded through the Population Health Research Network (PHRN), a national initiative established under the National Collaborative Research Infrastructure Strategy (NCRIS). This paper describes the development of the processes and methodology required to create cross-jurisdictional research infrastructure and enable aggregation of State and Territory linkages into a single linkage "map". Methods: The CDL has implemented a linkage model which incorporates best practice in data linkage and adheres to data integration principles set down by the Australian Government. Working closely with data custodians and State-based data linkage facilities, the CDL has designed and implemented a linkage system to enable research at national or cross-jurisdictional level. A secure operational environment has also been established with strong governance arrangements to maximise privacy and the confidentiality of data. Results: The development and implementation of a cross-jurisdictional linkage model overcomes a number of challenges associated with the federated nature of health data collections in Australia. The infrastructure expands Australia's data linkage capability and provides opportunities for population-level research. The CDL linkage model, infrastructure architecture and governance arrangements are presented. The quality and capability of the new infrastructure is demonstrated through the conduct of data linkage for the first PHRN Proof of Concept Collaboration project, where more than 25 million records were successfully linked to a very high quality. Conclusions: This infrastructure provides researchers and policy-makers with the ability to undertake linkage-based research that extends across jurisdictional boundaries. It represents an advance in Australia's national data linkage capabilities and sets the scene for stronger government-research collaboration. [ABSTRACT FROM AUTHOR]

Abstract: This paper is concerned with the problem of balancing the competing objectives of allowing statistical analysis of confidential data while maintaining standards of privacy and confidentiality. Remote analysis servers have been proposed as a way to address this problem by delivering results of statistical analyses without giving the analyst any direct access to data. Several national statistical agencies operate remote analysis servers [Australian Bureau of Statistics Remote Access Data Laboratory (RADL), ; Luxembourg Income Study, ]. Remote analysis servers are not free from disclosure risk, and current implementations address this risk by “confidentialising” the underlying data and/or by denying some queries. In this paper we explore the alternative solution of “confidentialising” the output of a server so that no confidential information is revealed or can be inferred. In this paper we review results on remote analysis servers, and provide a list of measures for confidentialising the output from a single regression query to a remote server as developed by Sparks et al. [R. Sparks, C. Carter, J. Donnelly, J. Duncan, C.M. O’Keefe, L. Ryan, A framework for performing statistical analyses of unit record health data without violating either privacy or confidentiality of individuals, in: Proceedings of the 55th Session of the International Statistical Institute, Sydney, 2005; R. Sparks, C. Carter, J. Donnelly, C.M. O’Keefe, J. Duncan, T. Keighley, D. McAullay, Remote access methods for exploratory data analysis and statistical modelling: privacy-preserving Analytics™, Comput. Meth. Prog. Biomed. 91 (2008) 208–222.] We provide a fully worked example, and compare the confidentialised output from the query with the output from a traditional statistical package. Finally, we provide a comparison the confidentialised regression diagnostics with the synthetic regression diagnostics generated by the alternative method of Reiter [J.P. Reiter, Model diagnostics for remote-access regression servers, Statistics and Computing 13 (2003) 371–380]. [Copyright &y& Elsevier]

Abstract: This paper is concerned with the challenge of enabling the use of confidential or private data for research and policy analysis, while protecting confidentiality and privacy by reducing the risk of disclosure of sensitive information. Traditional solutions to the problem of reducing disclosure risk include releasing de-identified data and modifying data before release. In this paper we discuss the alternative approach of using a remote analysis server which does not enable any data release, but instead is designed to deliver useful results of user-specified statistical analyses with a low risk of disclosure. The techniques described in this paper enable a user to conduct a wide range of methods in exploratory data analysis, regression and survival analysis, while at the same time reducing the risk that the user can read or infer any individual record attribute value. We illustrate our methods with examples from biostatistics using publicly available data. We have implemented our techniques into a software demonstrator called Privacy-Preserving Analytics®(PPA®), via a web-based interface to the R software. We believe that PPA® may provide an effective balance between the competing goals of providing useful information and reducing disclosure risk in some situations. [Copyright &y& Elsevier]