Balancing 

respondent confidential

and data user needs

Consumer Expenditure Survey

Arcenis Rojas
What is the crux?

 Conflicting goals

Maximize data accessProtect respondents identity
Why is confidentiality import

 Ensure future cooperation by 

respondents

 It’s the law 
Title 13? 

Federal law to protect 

identities of survey respon
Who determines threats?

 Disclosure Review Board (DRB)

by the U.S. Census
How could microdata revea

respondents’ identity? 

 High income  High expenditures High age Small PSUs
How to protect 

respondents’ confidentiality

Conceal information 

that could reveal responde
How to protect 

respondents’ confidentiality

Two stages: Census removes obvious identifie BLS suppresses data related ident
How to protect 

respondents’ confidentiality

 Top-code: Provide average of 

expenditures above threshold 

 Re-code: Change metadata 

but provide numerical data

 Suppress: Delete numerical data 

entire record
How to protect 

respondents’ confidentiality

 Top-code: Provide average of 

expenditures above a threshold 

 Re-code: Change metadata 

but provide numerical data

 Suppress: Delete numerical data 

entire record
How do we topcode?

 Determine critical value Find values exceeding critical valu Average values exceeding critical  Replace values with top-coded va
Topcoding example

 -

 100 200 300 400 500 600

0 2 4 6 8 10 12 14 16 
Topcoding example

 -

 100 200 300 400 500 600

0 2 4 6 8 10 12 14 16 

Critical value 
Topcoding example

 -

 100 200 300 400 500 600

0 2 4 6 8 10 12 14 16 

Extreme values 
Topcoding example

 -

 100 200 300 400 500 600

0 2 4 6 8 10 12 14 16 

Topcoded values 
How to determine critical valu

 Percentiles: 

Population & expenditure: 99.5 %Sample: 97 % 

 Outside sources: 

If sample differs from population
Distribution in Sample

 -

 2 4 6 8

 10 12 14 16 18

 - 2 4 6 8 10 

Outlier?
Distribution in Population

 -

 100 200 300 400 500 600

0 2 4 6 8 10 12 14 16 

probably not
How to protect 

respondents’ confidentiality

 Top-code: Provide average of 

expenditures above a threshold 

 Re-code: Change metadata 

but provide numerical data

 Suppress: Delete numerical data 

entire record
How do we recode?

 Find values that meet criteria Determine method: 

Generalize infoChange info

 Replace original metadata 

with recoded metadata 
Re-code: Generalize informa

 Broaden production year of cars

From Toyota Corolla 1999 To Toyota Corolla 1990s 
Re-code: Change informatio

 Change data to comparable data Change respondents’ age over 82 
How to protect 

respondents’ confidentiality

 Top-code: Provide average of 

expenditures above a threshold 

 Re-code: Change metadata 

but provide numerical data

 Suppress: Delete numerical data 

entire record
Suppress

Delete the reported data o

delete the entire record
How to suppress?

 Blank out numerical value 

but maintain metadata

 Erase entire record
Suppression

 Blanking numerical data

Blank values of normal 

but infrequent purchases

Example: Specialized mortgages
Suppression

 Complete eradication 

Erase entire recordExample: Airplane purchase
Reverse engineering

5 = 3 + X 

What’s X
Reverse engineering

Prevent the use of availabl

information to deduce protec

information
How to prevent reverse engine

 Find protected values Protect them in all locations  Protect related values 
Reverse engineering

 Scenarios

Within fileAcross files
Reverse Engineering: 

Within File

 Income = Wage + taxes  1000 = 800 + 200 1000 = 750 + 200 950 = 750 + 200  Critical value: 700  Topcode value: 750
Reverse Engineering: 

Within File

 Income = Wage + taxes  1000 = 800 + 200 1000 = 750 + 200 950 = 750 + 200  Critical value: 700  Topcode value: 750
Reverse Engineering: 

Within File

 Income = Wage + taxes  1000 = 800 + 200 1000 = 750 + 200 950 = 750 + 200  Critical value: 700  Topcode value: 750
Reverse Engineering: 

Within File

 Income = Wage + taxes  1000 = 800 + 200 1000 = 750 + 200 950 = 750 + 200  Critical value: 700  Topcode value: 750
Reverse Engineering: 

Across Files

 Income 

Topcoded income in FMLI => Topcode associated UCC in IT

 Expenditure

Topcoded expenditures in EXPN/F=> topcode associated UCC in MT
How do we document?

 Flag the values



T: Topcoded value 



D: Valid value
What percentage of data poi

changed? 

 Un-weighted impact:  Weighted impact: 
Impact on trends?

 No: ?????? Small: ?????? Large: Area and income extreme
Arcenis Rojas

(202)-691-6884

Rojas.Arcenis@bls.gov
Next presentation...