Applying Disclosure Control to Temporal Data 

Anna Manning and Mark Elliot 

Dept. of Computer Science, L'nivcrsit)' of Manchester, Ml3 9PL, UK 

anna@cs.man.ac.uk 

Cathie '.\larsh Centre for Ct>mus and Surn·y Rc~earch, Uni"·ersitJ of Manchester. M13 9PL, UK 

rnark.elliot@man.ac.uk 

Abstract 

An important aspect of disclosure control is the isolation and control of individual-level records that have a high probability 

of being identified (as their contents, or variables. are unusual) - consider, for example, a sixteen-year-old widow. However, 

many such datasets contain temporal information relating specifically to an individual which needs to be addressed when 

making such decisions. An unusual temporal sequence of events pertaining to an individual has the potential to lead to 

disclosure but is missed if the analysis is restricted to a single period in time. 

Algorithms have been specifically designed to conduct a comprehensive search for "risky" records in survey-type data in a 

single period of time. This paper examines the extension of one of these for finding temporal sequences which may pose a 

disclosure risk to individuals in a datasets. Preliminary results indicates that this methodology has the potential to enhance 

disclosure control techniques significantly. 

1. Introduction 

The analysis of data collected over time (temporal data) has the potential to reveal the dynamic behaviour of an individual or 

group and is an important means of collecting information. The value of knowledge captured m temporal data is reflected m 

the growing interest m temporal data minmg, the goal of which is to discover new, implicit, relationships and patterns over 

time. It is a rapidly growing area of research that brings together many disciplines including statistics, temporal pattern 

recognition and high-performance computing [Garofalakis et al. 1999, Srikant ct al. 1996, Yan et al. 2003, Zaki et al. 2001] 

Such techniques can reveal sensitive information about individuals and groups within temporal data and it is therefore 

important that careful consideration is given when releasing such data. 

Temporal data can be discrete or continuous. The term lime series is often used in statistics to refer to one (or few), but 

usually long, series of continuous, real-valued elements. Longitudinal studies, which are addressed here, are generally 

repeated measurements where the repetition is taken m time and are usually concerned with many but short series, often 

augmented in groups. They also differ from 1raditional time senes analysis because the measurements are regarded as a 

sample from some underlying population. 

Disclosure limitation in longitudinal linked data in a well-recognized problem [Adowd and Woodcock 2001] and one that can 

occur at individual-level, at employer level, at household level etc. depending on which groups are represented in the data. In 

this paper we concentrate on individual-level risk and focus on the identification of records which are particularly risky rather 

than on the methods used to mask them. Examples are drmvn from the UK Labour Force Survey 1 \vhich is a longitudinal 

linked data set containing individual-level (and household level) observations. 

Some records have a high probability of being idemified as thclf contents, or attributes, are unusual and therefore have the 

potential to be recognized spontaneously - such records arc referred to as special uniques [Elliot 2000]. A sequential 

algorithm, SUDA (Special Unique Detection Algorithm) [Elliot ct al. 2002] has been developed to locate special unique 

records from a given period in time by first identifying all record-level unique attribute patterns (up to a user-specified 

maximum size) and, secondly, by grading the risk of each record by considering the number and distribution of unique 

: Office for Nat10nal Statistics Labour Market Division, Labour Force Survey Five-Quarter Longitudinal Dataset, June 1999 

- August 2000 [ computer file]. Colchester, Essex: UK Data Archive [ distributor], 21 June 2001. SN: 4304. 

Page 13 
patterns that it contains. The SUDA algorithm has been shown to be efficient at picking out records with a high level of risk 

In thi~ paper the extension of SUDA to longitudinal data is explored and demonstrated. 

2. SUDA 

SUDA has been designed to provide a comprehensive search for special unique records in a given dataset. A two-stage 

approach is employed: firstly, all unique patterns (up to a user-specified size) are located at record level and, secondly, the 

size and distribution of unique patterns within each record is used to grade its 'riskiness'. In order to streamline the search 

SUDA has been structured around the observation that 'Every superset of a umquc pattern is itself unique' (as every unique 

pattern is bounded by the size of its subsets). Only unique patterns \.Vithout any unique subsets, minimal unique pa/terns, are 

considered in order to avoid the use of redundant information and to keep the classification process as focused as possible; 

the smaller the number of attributes contained in a unique pattern the more 'risky' it is considered to be and therefore it 1~ 

important to know if a unique pallern is minimal or not. SUDA has been developed for discrete data (both numerical 

attributes and numerically coded categorical data) but can also accept continuous data if it is transformed into a discrete fonn 

beforehand (via multiplication by factors of 10 and/or rounding up). 

Clearly, all possible attribute sets must be considered in order for an exhaustive <;earch for minimal unique pattern~ to he 

conducted. However, to minimize computation time, SCDA selects all attribute sets with the same prefix2 in succession so 

that any c.\tensions of a unique prefix at a given record are ignored \\ithout reverting to stored information. For example, 

given four attributes, labelled a1, a2, a3, a4, the sets with prefix a2 are: {al}, {a2,a3}, {a2,a.1,a4), {a2,a4 ). If attribute a2 was 

found to be unique for record R then attribute sets {a2,a3}, ja2,a3,ai} and {a2,ai) could be ignored for that record. This has 

the effect of reducing the number of records that need to be considered for each attribute set while at the same time 

minimizing memory usage. 

The process of identifying minimal unique patterns is conducted by partitioning the dataset according to the value of each of 

the attributes in a given attribute set. For example, if the attribute set was (AGE, SEX) the dataset would be divided into 

groups of record, containing attributes with values such as (AGE=20, SEX=male), (AGE=40, SEX'=female) etc. Any group 

containing only one record represents a umque and a check for minimal uniqueness would then be made. The minimal 

uniqueness of a unique pattern X of size n (where 11 ~ 2) is detennined by confirming that all subsets of X of size n-1 are nonumquc. The partitioning method of SUDA has the effect of minimizing the amount of data storage that is necessary to 

identify minimal uniques by localizing the required inforniation. In addition, the generation of attribute sets according to 

their prefixes allows this partitioning procedure to be undertaken efficiently and without redundant sorting [Elliot et al. 

2002]. 

3. How can SUDA he applied to longitudinal data? 

As described above, SUDA is currently designed for applicat10n to data collected m a single time period. Figure I illustrates 

the nature of the data. Each individual is rcprc~ented by a record (row) in the dataset containing a fixed number (c) of 

attributes. The i

th record is represented by (a 1,, a2" ..• , ac,) and there are a total ofr records altogether. 

au a21 ac1 

312 322 3c2 

3tr 32r 3cr 

Figure 1: Data from a single time period 

: In general, for an attribute set A contaming c attributes a 1, .. a0, a prefix of size P of A where I SP Sc contains the first P 

attributes (a1, ••• ,ap) of A. 

Page 14 
Figure 2 illu~trates the nature of longitudinal data, \Vith one set of r records of a fixed length of c attributes fort time periods. 

Each attribute is represented by auk where i=-attribute number,j= record number and k=time period. 

3JII 32JI ... ac11 3112 a212 ac12 311t 321t 3ctt 

3121 a221 ... ac21 r-'I 3122 3222 ... ac22 i--. 3121 3221 ac2t 

... . . . ... . . . . . . ... ... . .. 3Jr1 a2r1 ... 3crl 31r2 32r2 ... 3cr2 3trt 32rt 3crt 

. .. 

figure 2: Data from t time periods 

A sequential pattern pertaining to record i, attribute j is represented as follows: 

(Sequence 1) 

This sequence is unique if any of its subsequences are unique. Sequential patterns can include more than one attribute. For 

example, at sequential pattern pertaining to record i, attributes j and k is represented as follows: 

(aij !, akJ J) -> (aij2, ilkj2) -> · · · -> (aijt, akjt) (Sequence 2) 

How can the disclosure risk of a sequential pattern be assessed? The most logical method of extending SUDA would be to 

compare a given sequential pattern with eYery other sequence of the same kind in the data in order to detem1ine \vhether it is 

unique or not. The SUDA approach is ad\'antageous as it identifies subsequences that arc m1mmally unique and it is possible 

to judge how risky a record is based on thi~ information; the smaller the subsequence the more risky the entire sequential 

pattern is likely to he. 

ln order for SUDA to he applied to sequential pa!tems consideration needs to be given to the data input. As discussed ahovc. 

SUDA accepts data in the fom1 shown in Figure 1. It is straightfon-vard to organize data in this way for a sequential patterns 

consi~ting of a single attribute. For example, if an attribute such as marital status is captured by the i

th attribute in each record 

then the corresponding values of thi~ attribute from all records in all time periods can be gathered together, with one 

sequential pattern per individual - i.e. SUDA would he applied to the data in Figure 3. 

ai11 au2 

am ai22 

3irl 3ir2 

Figure 3: Sequential sequences for the i

th attribute 

Applying SUDA in this way would find all unique subsequences whose components arc not necessary consecutive. It would 

be possible to adapt the search so that only consecutive events are considered. It may also he possible to adapt the search so 

that larger time windO\VS are considered - for example, it would be pm~ible to consider unique subsequences over a time 

window of a year from data that is collected every three months. 

To find all unique sequential panems in the form of sequence 2 above, SUDA would be applied to the data in Figure 4. 

Page 15 
(3p1, 3k!1) 

(3j21, 3k2!) 

(a;12, 3kn) 

(a;22, 3k22) 

(aj11, ak1t) 

(aj21, akzt) 

Figure 4: SclJUential scqurnces for the jth and kth attribute 

For SUDA to accept this data as input each of the data items in brackets must be treated as one unit. There are three main 

approaches to this: 

(1) SUDA is applied separately to each time period simultaneously (using parallel processing) and the results for each 

sequence collected together after this procedure is complete. 

(2) The values for each set of attributes are mapped to a unique integer representation and SUDA is applied once to the 

resulting data. 

(3) A multivariate version of SUDA is produced so that datasets, such as the one in Figure 4 could be processed 

immediately. 

In this paper method 2 has been used. For example, with attributes AGE (95 possibilities) and SEX (2 possibilities) the 

combined attribute has 2 x 95 = 190 possibilities (one for male or female in each age group). These combined values can be 

decoded once SUDA has finished. 

The algorithm was applied to the Labour Force Survey Five-Quarter Longitudinal Dataset_ .lune l 999 - August 2000 (10, 951 

records) and the next section demonstrates the effectiveness of the extended SCDA algorithm, temporal SUDA, for locating 

unusual and potentially risky sequential patterns. 

4. Applying temporal St.:DA to the LFS- some observations 

In order to demonstrate the application of SUDA to temporal data the sequences that were found to be most "risky" (i.e. m 

terms of the number of unique subsequences that they contain) for different types of attributes are presented as follows: 

(1) ,1sT A TUS - Marital status: This attribute is clearly constrained in the options available over time - for example, an 

indiYidual cannot be divorced until sll1e has been married. The attribute can take five values as shown in Figure I. When 

temporal SUDA was applied to MST ATUS over all five time periods of the LFS data 17 unique sequential patterns were 

found. containing a total of38 minimally unique sub~cquences of ~ize 2 and 9 of size 3 and these are presented in Table 2. lt 

can be ~een that temporal SUDA is capable of detecting ~equcnces that show an unusm1l progression of this attribute over 

time: for example. the first sequence shows an individual \\'hose marital status changed from '\ingle" to "divorced" over two 

time periods which 1s very unexpected as this suggests that they must also have been married during this time. Other 

~equences suggest errors in the data~ for example sequences 3, 11 and 12 all end with "single, never married" even though 

the beginning of the sequence suggests otherwise. The sequences become less unusual the fewer minimally umque 

sub~equences they contain, suggesting that the SUDA approach is efficient for this problem. 

Code Detail 

2 

) 

4 

Single, never married 

Married, living with husband/wife 

Married, separated from husband/wife 

Divorced 

5 W1dov.ed 

Table 1: Attribute values for marital status 

UnilJUe ~uhscqucnces: Sequential 

Page 16 
5. Discussion and further work 

Section 4 demonstrates that temporal SUDA can pick out unusual sequential patterns pertaining to an individual which could 

pose a disclo'iure ri~k. \Vhen an attribute naturally possesses restrictions on the ~equence of values it can take it appears this 

gives more potential for "risky" sequences as it can be seen immediately that a generally accepted course of events has not 

occurred. An attribute that is free to take all values appears to present less surprising results. 

At present, SUDA is being applied to one sequential pattern at a time. The next step is to develop the algorithm so that it can 

conduct a search for all minimally unique sequences. Some thought will be required as to how to incorporate the search for 

minimally unique patterns during one time period with the ~earch for minimally unique sequential patterns over all time 

period~- Attention also needs to be given to the weight allocated to each of these sequences. 

Rcfcn·nces 

Abowd, John M. and Woodcock, Simon D. (2001), 'Disclosure Limitation in Longitudinal Linked Data', in Confidentiality, 

Disclosure, and Dara Access Theory and Practical Applicario11sfor Statistical Agencies, North Holland, 2001 

Elliot. M. J. (2000), 'A new approach to the measurement of statistical disclo~ure risk'. International Journal of Risk 

Management, 2(4), 2000. 

Elliot, M. J.. \fanning, A. M. and Ford, R. W. (2002), 'A computational algorithm for handling the special uniques problem', 

In !ntenwrionul Journal of Uncertainzr, Fu::.::.iness und Knowledge Based Systems, Vol. 10, No. 5, pp 493-509. 

Garofalakis, Minos N .. Rastogi, Rageev and Shim, Kyuscok (1999), 'SPJRIT: Sequential Pattern Minmg ,,.,..ith Regular 

Expression~ Comtraints'. In Proceedings oflntl. Conj Very Large Databases (VLDB), pp 223-234,, Edinburgh, 1999. 

Srikant. Ramakrishnan and Agrawal, Rakesh (1996), 'Mining sequential patterns: Generalizations and perforance 

improvements'. In proceedings of the lnremational Co1~ference m1 Extending Database Technology (EDBTj, pp 3• 17, 

Avignon, France. 

Yan X., 1-Ian, Land Afshar, R. (2003), 'CloSpan: Mining Closed Sequential Patterns in Large Datasets', (to appear) in SIAM 

Duta mining 2003. 

Zaki. Mohammed Javeed (2001), 'SPADE: An Efficient Algorithm for \1ining Frequent Sequences', Machine Leaming 40: 

31-60. 

Page 17 
oattern 

Size I Size 2 Size 3 

0 4 0 14444 

0 4 0 22444 

0 4 0 5 I 1 I 1 

0 4 0 44333 

0 4 0 5 5 5 5 2 

0 3 0 I I l 2 3 

0 2 0 44443 

0 2 0 2 2 5 5 5 ' 0 

0 

2 

2 

0 

0 

22224 

2 2 2 2 5 

! 

! 

0 2 0 2 2 I 1 I 

0 2 0 2 2 2 1 1 

0 l 2 2 2 3 3 2 

0 0 4 3 3 2 3 3 

0 0 3 2 3 2 2 2 

0 l 0 34444 

0 l 0 33444 

Table 2: Umqur sequential patterns for MST ATUS 

(2) JNECACA - Basic economic activity: This allrihute has little restriction on the changes that may occur and is therefore 

far less predictable. J"'.'JECACA comists of 30 categories ranging from "Employee" to "Unemployed") 

1048 unique sequences were identified with a total of 4 minimally unique subsequences of size 1, 743 of size 2, 1597 of size 

3, 260 of size 4 and 6 of size 5. Most unique sequences belonged to individuals who were in temporary or unskilled work or 

to those who were not working and moving between states of inactivity. The sequences were not very suprising as those in 

such groups would be expected to h<1vc ch<1ngeable values for this attribute. 

(3) AGE: h entirely predictable over time. 

Although this attribute is entirely predictable owr time, 18 unique sequences fearuring the same age in all 5 time stamps (i.e. 

over the 15 month period) were identified which wa~ surprising. One possible explanation is that birthdays coincide with the 

start of data collection for the first time stamp and suggests that Date of Birth could be derived (by considering AGE) from 

the file. and this information disclosed. For this file, however, Date ofhirth already appears and there 1s no risk of disclosing 

further information. 

(4) AGE and :\1STATL'S comhined. 

\Vhcn these two attribute~ arc considered together 3 17 unique sequences were discovered consisting of 70 minimally unique 

~ubscquenccs of size 1, 745 of size 2, 44 of size 3 and 1 of size 4. 

Four sequences were found to have unique patterns of size 1 in each of their five time periods - i.e. five sequential 

subsequences of size I each - which is the maximum possible: 

(mstatus=2, age= 18) -> (mstatus=2, age=] 8) -> (msta!US""2, age= 18) -> (mstatus=2, age= 19) -> (mstatus=2, age=l 9) 

( mstatus=2, age=- 1 9) -> (mstatus=2, age= I 9) -> (mstatus=3, age=20) -> ( mstatus= 3, age=20) -> ( mstatus= 3, age=20) 

(mstatus=S, age=30) -> (mstatus=5, age=31) -> (mstatus=5, agc=3]) -> (mstarus=5, age=31) -> (mstatus=5, age=3 I) 

(m~tatus=5, agc=34) -> (mstatus=5, age-34) -> (mstatus=5, age=-34) -> (mstatus"'5, age=34) -> (mstatu~=5, age=35) 

The following sequence has 7 unique subsequences and shows someone m their mid-nventies moving from 

mstatus="divorced" to mstatus="married" 

(mstatus=4, age=24) -> (mstarus=4, age=24) -> (mstarus=4, agc~24) -> (mstatus=2, agc=25) -> (mstarus=2, age=25) 

Page 18