Treatment of statistical confidentiality Introductory course Trainer: Felix Ritchie CONTRACTOR IS ACTING UNDER A FRAMEWORK CONTRACT CONCLUDED WITH THE COMMISSION

Before we begin… Who are we, and why are we here?

Aims and objectives: general Overall objective: to disseminate basic knowledge in methods of statistical disclosure control (SDC) and the considerations involved when applying these methods to real-world data. Pedagogical model: understanding what and why is more important than how at this stage This course should equip students with the skills to evaluate, take decisions on and recommend to others confidentiality protection methods to be employed in Eurostat’s work. It is not designed to make you an expert in specific technical areas. There is an enormous literature on technical aspects of SDC, including the Eurostat-sponsored manual (2010) which is full of extensive technical and methodological discussions. This course simplifies and summarises those findings. It is designed to give you the confidence to make decisions and challenge the decisions of others, based on a solid understanding of principles. This course is based on the trainer’s twelve years experience (with the help and advice of many others) designing ways to make confidentiality protection meaningful to people who previously only saw it as a another box to tick. The conceptual approach differs from traditional confidentiality courses which focus on technical skills, but is increasingly accepted as best practice (including by Eurostat).

Aims and objectives: specific At the end of the course students should be able to: identify confidentiality risks in different contexts specify risk scenarios, evaluating the appropriateness of alternative approaches to specific situations understand the main problems in SDC on inputs and outputs understand advantages and disadvantages of some specific different SDC methods understand the role of confidentiality protection in the European Statistical System understand the role of the Argus programs This course will concentrate on an understanding of confidentiality protection principles operational processes the relative value of different approaches The most important objective is understanding why. The advanced courses run by Eurostat provide detailed technical knowledge of the Argus programs, SAS code and other technical tools. After this course, we also hope that you will feel comfortable talking to technical specialists from universities, for example.

Target audience This course is designed for staff working with confidential data who need to have a basic knowledge of confidentiality measures methods of statistical disclosure control (SDC) the considerations involved when applying these methods to real-world data We assume a basic level of maths and statistics, and familiarity with Excel Technical requirements for the course are low – for reasons which will become clear, advanced statistical models rarely generate confidentiality risks, and the way to identify those risks is mostly the same as for simple tables.

Course outline Principles of statistical confidentiality protection concepts in data protection and statistical disclosure control (SDC) data issues relevance to European statistics Tabular data protection Non-tabular outputs Protecting microdata Thinking about data protection This course covers four key topics: Principles, covering: taxonomy of SDC, including issues such as identity and disclosure; using the ‚Five Safes‘ framework for assessing risk and solutions; distinguishing between legal and practical definitions; principles-based output SDC; the impact of different types of data on confidentiality decisions. The ‚Five Safes‘ framework will be used to explore alternatives to restrictng data quality Tabular data: this is likely to be the most common output of EC units and so we will spend some time on this. It is also the easiest way to explore many of the specific concepts of SDC, such as primary and secondary disclosure. We will also explore how we deal with tables in inputs. We mainly use simple numerical examples studied as a group. We will also look at a specialist tabular protection tool, tau-Argus Non-tabular outputs: we will explore principles-based output SDC further, and explore the concept of ‚safe‘ and ‚unsafe‘ statistics; and we will show how dealing with tables fits within a general framework designed to deal with all types of output; we will then see how the simple ‚rules‘ introduced in the first part should be seen as a specific instances of a more general approach Microdata: we will consider how microdatasets can be used safely, and briefly introduce the automatic tool mu-Argus We will finish by reviewing how we think abotu data protection; this will bring many of hte themes of the course back together.

Warning! All the data used in the course is invented: all the numbers used in this course are invented any statements about countries, companies, individuals are invented all parameters used in assessing confidentiality are for illustration only Eurostat has guidelines on specific thresholds to be used in practice A reminder: all the examples here use invented numbers for illustration, so do not read anything into them. In your work, you will be told what are the relevant thresholds et cetera (they may be specific to countries); the Methodology Division at Eurostat can provide formal information on ESS parameters. Avoid discussing specific confidentiality parameters if you have to discuss in public, try to be general or over-cautious never base an SDC plan on the assumption that parameters are kept hidden – they will almost certainly leak out at some time

Questions? CONTRACTOR IS ACTING UNDER A FRAMEWORK CONTRACT CONCLUDED WITH THE COMMISSION