Data Access and Confidentiality 

Project: Regulation Update

Spiro Stefanou

Administrator

Economic Research Service, USDA

2022 Research and Policy Conference 

October 25-27, 2022, Washington, DC

Session E-5: Implementing Title III of the Evidence Act: A Framework to Expanding Data Access 

for Evidence Building

October 26. 2022

1
Big Picture

Chief Statistician’s Data Access and Confidentiality Project

 Themes

 Regulation Plan

 Stakeholder Engagement Plan

 Methods Coordination Plan

 Phase 1 Delivered 

 Phase 2 to be delivered 

2

Phase Phase Name Role for Principal

1 Vision and Goal Setting Plan and design

2 Implementation Champion and support for staff who are 

executing implementation

3 Revisit Vision and Goals Lead effort
Regulation

3

Elicit feedback on goals, 

principles, and frameworks

Shared understanding of the 

challenges 

Identify innovative ways to meet 

the goals and overcome challenges

Engaging ACDEB 

Subcommittees
Regulation

Goals and Guidance for Developing Expanding Secure Access to Data Regulation 

(Evidence Act Section 3582)

Regulation Goals

 Shared responsibility for protecting data

 Treating privacy/re-identification as a continuum

 Address both current and future data holdings of the Federal Statistical System

Per Section 3582 Regulation Must Include

 Standards to assess for each data asset

 sensitivity level

 corresponding level of accessibility

 whether less sensitive versions can be created

 Standards to improve access by removing/obscuring identifiers

 Requirement to conduct re-identification risk assessments

 Requirement to make processes transparent and easy to understand

4
Regulation 

Example Guidance on Regulation "Must Dos"

5

Sensitivity Levels: "Not all data are equally sensitive. Our 

regulation should not create a presumption of equal 

sensitivity."

Risk Assessments: "Re-identification risk is only one 

component of a risk assessment. The regulation must 

also consider reputational risk to an agency and concerns 

regarding respondent trust."

Removing/Obscuring Identifiers: "Guidelines we set for 

data sets standing alone may be insufficient when those 

data sets are linked to other data sources. When 

articulating guidelines, consider linked data."
Regulation 

Goals and Guidance for Developing Expanding Secure Access to Data Regulation 

(Evidence Act Section 3582)

Known Constraints

Use of Agency-specific confidentiality laws and how they fit 

into a CIPSEA framework

Data agreements to procure or collect past data often have 

limitations on data use

Budget 

6
Regulation Plan

7

General Principles

1. More (Not Less) Data Available

2. Not All Data Are Equally Sensitive

3. Disclosure Risk Is a Continuum

4. Consistent With Other CIPSEA Efforts

5. Address Current and Future Data

6. Shared Responsibility

7. Protect Good Faith Actors from Unknown Disclosure Risks

8. Consider Linked Data

9. Consider Multiple Audiences in Determining Sensitivity

10. Risk Assessments More Than Re-identification Risk

11. View Expansively – Improve Access to Administrative Records

12. Cost Effectiveness

13. Consider Agency-Specific Privacy Laws
Document Status

o The document is being fine-tuned finalized within the team.

o The document is not the final regulatory text, but concepts 

to introduce for consideration.

o Accomplished our goal to hew as tightly as possible to Section 

3582 and to incorporate as many of the ICSPs 13 guiding 

principles as are relevant.

o Draft is aligned with other guidance and regulations: 

o SAP (Evidence Act section 3583), 

o Trust regulation (Evidence Act section 3563a) and 

o other ICSP engagement documentation.

8
Elements of the Regulation Draft

 Codifying and clarifying definitions

 Risk Assessment Process: An expectation of "acceptable risk“

 Transparency 

 Role of Data Review Boards and Data Review Officers 

 “Safe for Dissemination” CIPSEA Determinations 

9
Next Steps: Incorporating input

 ACDEB – report just released

 Consultation with SAHs 

 Roll out plan

10
Questions?

11