Discussion of Talks on Formal Privacy and Surveys

Jerry Reiter

Department of Statistical Science

Duke University

Any views expressed are those of the author and not necessarily of the Census Bureau.

Talks I will discuss today

Aref Dajani.  “Adapting Surveys for Formal Privacy:Where We Are, Where We Are Going.”

Mark Bun, Jörg Drechsler, Marco Gaboardi, Audra McMillan, Jayshree Sarathy.  “Controlling Privacy Loss in Survey Sampling: an Analysis of Stratified and Cluster Sampling.”

Big picture remarks on Dajani’s talk

Census Bureau and formal privacy: innovative, leading edge, and commendable.

Big kudos for accurate interpretations of DP definition

“DP bounds the change in the inference made about a person or establishment, whether that person/establishment chooses to participate in the survey and is included in the data...or not.”

“It is not possible to responsibly disseminate information products from any survey or census with no disclosure risk.” 

Dajani: Specific thoughts 1

ε represents a bound on the incremental risk.

Just because a release is DP does not mean an agency should disregard disclosure risk assessments.

Large ε like those used in practical applications could come with disclosure risks.

Two DP algorithms with the same ε could have different disclosure risk properties for different kinds of attacks.

We need statistical disclosure risk measures that account for formal privacy protections

Bayesian approaches (e.g., Reiter 2005) offer paths forward.   But much work to be done....

Dajani: Specific thoughts 2

Tension between the principled and the practical

For now, it seems that the Census Bureau may not strictly enforce a privacy budget for all queries of a database (e.g., GASP may not be formally private).

Sometimes one has to get things done!

What are the implications for disclosure risk of releasing a mix of formally private and not formally private statistics?

Dajani: Specific thoughts 3

Disclosure risk assessments often focus on risks that individuals can be re-identified/participated in a database.

For many government surveys and censuses, why should participation be confidential?  

Does someone knowing that I participated in the ACS have any implication for my well being?  

Laws written in terms of re-identification, but perhaps those should be revisited...

An intruder knowing if someone is a member of a dataset may matter for some databases, but need it be the default?

Perhaps it is time for more focus on attribute disclosures than re-identification disclosures.

Big picture remarks on Bun’s et al. talk

Investigating DP in complex surveys: moving from hypothetical to practical.  (A good thing!)	

Considering privacy at the design stage, not after the data are collected.  (Another good thing!)

Providing guidance one what kinds of designs might allow for privacy amplification and what might not, and how old intuition from survey sampling may not apply with formal privacy considerations. (A trifecta!)

Bun et al: Specific thoughts 1

Privacy amplification happens with simpler designs.

DP is also easier to implement without high variance survey weights typical of complex surveys.

Should we rethink the use of complex survey designs for some data products, especially those intended primarily for secondary research?

Might the negative effects of privacy protection on inferential accuracy outweigh the efficiency gains from using a complex sampling design?

Bun et al: Specific thoughts 2

Suppose people/establishments are not secretive about their survey participation.

Neighbors, employers, or partners know individuals who participated in a survey.

Individuals reveal survey participation on social media.

How does one characterize the privacy amplification when part of the sample is secret and part is not? 

What does privacy amplification mean if we no longer are required to protect membership in a survey?

Final thoughts on the papers

I congratulate the presenters on their thought-provoking work, and I look forward to seeing their work develop further.

Thank you to the audience for attending our session.