Appendix A

Technical Details on Measuring Disclosure Risk

Denote F_k as the population size and f_k the sample size in cells k defined by cross-classifying the K key variables. The set of sample uniques is defined as SU = {k:f_k = 1}, and these are the high-risk records in the public-use file that have the potential to be population uniques. The DIS measure (Skinner & Elliot, 2002) is defined as

$DIS=\frac{{\displaystyle {\sum }_{k}I\left(f_k=1\right)}}{{\displaystyle {\sum }_{k}I\left(f_k=1\right)}{F}_k},$

where I is the identify function. The DIS measure is the number of sample uniques divided by the sum of the population sizes in those cells defined by SU. The advantage of the DIS measure is that it can easily be estimated without the need for any probabilistic modeling. The estimate for the DIS is

$\widehat{DIS}=\pi n_1/\left[\pi n_1+2\left(1-\pi \right)n_2\right],$

where π is the sample fraction, n₁ = ∑_k I(f_k = 1) the number of sample uniques, and n₂ = ∑_k I(f_k = 2) the number of sample doubles.

As mentioned in Chapter 3, generally the “fishing” scenario is not sufficient for statistical agencies as they need to assess the consequences of releasing a public-use file. Therefore, a more relevant disclosure risk measure is based on the attack scenario—that is, when an intruder has access to the confidential microdata and wants to make an identification based

on an external data source containing information about the population. Two main disclosure risk measures are

1. expected number of sample uniques that are population uniques: τ₁ = ∑_k I(f_k = 1, F_k), and
2. expected number of correct matches for sample uniques assuming a random assignment within cell k.

For example, if a sample unique matches to three individuals in the population, the match probability for that sample unique would be 1/3. Aggregating all match probabilities over the sample uniques leads to τ₂ = ∑_k I(f_k = 1) 1/F_k.

Shlomo and Skinner (2022) and Shlomo (2010) (and references therein) provide an overview of the literature on (a) measuring the risks of re-identification and (b) using probabilistic modeling to estimate the population sizes in cell k.

Using a probabilistic model, the risk measures are estimated by

$\widehat{{\tau }_1}={\displaystyle {\sum }_{k}I\left(f_k=1\right)}\hat{P}\left(F_k=1|f_k=1\right)$ and $\widehat{{\tau }_2}={\displaystyle {\sum }_{k}I\left(f_k=1\right)}\hat{E}\left(F_k=1|f_k=1\right).$

Skinner and Holmes (1998) and Elamir and Skinner (2006) propose a Poisson distribution and a log-linear model to estimate the disclosure risk measures. In this model, they assume that F_k~Pois(λ_k)for each cell k. A sample is drawn by Poisson or Bernoulli sampling with a sampling fraction π_k in cell k: f_k|F_k~Bin(F_k,π_k). It follows that

f_k~Pois(π_k λ_k) and F_k|f_k~Pois(λ_k(1 = π_k))

where the population cell counts F_k are assumed independent given the sample cell counts f_k.

The parameters λ_k are estimated using log-linear modeling. The sample frequencies f_k are independent Poisson-distributed with a mean of μ_k = π_k λ_k. A log-linear model for the μ_k is expressed as $log\left({\mu }_k\right)=x_k^{\text{'}}\beta$, where x_k is a design vector that denotes the main effects and interactions of the model for the key variables. The maximum likelihood estimators $\hat{\beta }$ are obtained by solving the score equations: ∑_k (f_k − π_kexp($x_k^{\text{'}}$β))x_k = 0.

The fitted values are then calculated by $\widehat{{\mu }_k}=exp\left(x_k^{\text{'}}\hat{\beta }\right)$ and $\widehat{{\lambda }_k}=\widehat{{\mu }_k/{\pi }_k}$. Individual disclosure risk measures for cell k are

P(f_k = 1) = exp (λ_k(1 − π_k))

E(1/F_k|f_k = 1) = (1 − exp(λ_k(1 − π_k)))/(λ_k(1 − π_k)).

Plugging $\widehat{{\lambda }_k}$ for λ_k in the formula above leads to the estimates $\hat{P}$(F_k = 1|f_k = 1) and $\hat{E}$(1/F_k|f_k = 1) and then to $\widehat{{\tau }_1}$ and $\widehat{{\tau }_2}$. Skinner and Shlomo (2008) develop a method for selecting the main effects and interactions of the log-linear model based on estimating and (approximately) minimizing the bias of the risk estimates $\widehat{{\tau }_1}$ and $\widehat{{\tau }_2}$. There have been many extensions and similar approaches to estimate the risk of re-identification based on probabilistic modeling and these are mentioned in Shlomo and Skinner (2022). In addition, the R package SDCNway on the CRAN network has been developed that carries out the probabilistic modeling for estimating the risk of re-identification.

This page intentionally left blank.