1 — U.S. BUREAU OF LABOR STATISTICS • bls.gov

Balancing 

Respondent Confidentiality 

and Data User Needs

Aaron E. Cobet

Consumer Expenditure Surveys

Microdata Users Workshop

July 20, 2017
2 — U.S. BUREAU OF LABOR STATISTICS • bls.gov

What is the Issue?

2

 Conflicting goals 

 Maximize data access

 Protect respondents identity
3 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Why is Confidentiality Important? 

 Ensure trust of respondents for 

their future cooperation

 Ethical responsibility to protect 

respondent confidentiality

 It’s the law 

3
4 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

What is Title 13? 

 U.S. Code: Title 13 allows the government to 

take a census and provides directives for its 

administration and enforcement.

 People who took the oath of office who 

wrongfully disclose information protected 

under Title 13 are subject to a fine of up to 

$250,000 or up to 5 years in prison.

 Census and CE staff need Title 13 clearance. 

4
5 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Title 13 Training 

 CE staff gain access to internal data after

completing 2 steps: 

1. Pass a background check by Census

2. Take the Title 13 training 

 CE staff are required to annually retake 

Title 13 training and pass a knowledge 

check to maintain Special Sworn Status

5
6 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Who Determines Disclosure Threats?

 Disclosure Review Board (DRB)

by the Census Bureau

6
7 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

How Could Microdata Reveal 

Respondents’ Identity? 

 Small PSUs

 High income 

 Extreme expenditures 

7
8 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

How to Protect Respondents’ 

Confidentiality?

 BLS and Census Bureau 

conceal information 

that could reveal 

respondents identity. 

8
9 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

How to Protect Respondents’ 

Confidentiality?

Two stages:

 Census removes direct 

identifiers, i.e. addresses

 BLS suppresses indirect 

identifiers, i.e. high 

expenses 

9
10 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

How to Conceal Indirect Identifiers?

 Topcoding: Provide average numerical 

value that are above a threshold

 Recoding: Change metadata but 

provide numerical value

 Suppression: Delete numerical value 

only or entire record

10
12 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

How do we Topcode?

 Determine critical value

 Find values exceeding critical value

 Average values exceeding critical value 

 Replace values with top-coded values

12
13 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Topcoding Example

 -

 100

 200

 300

 400

 500

 600

0 2 4 6 8 10 12 14 16 18 20

13
14 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Topcoding Example

 -

 100

 200

 300

 400

 500

 600

0 2 4 6 8 10 12 14 16 18 20

14

Critical value 
15 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Topcoding Example

 -

 100

 200

 300

 400

 500

 600

0 2 4 6 8 10 12 14 16 18 20

15

Extreme values 
16 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Topcoding Example

 -

 100

 200

 300

 400

 500

 600

0 2 4 6 8 10 12 14 16 18 20

Topcoded values 

16
17 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

How to Determine Critical Values?

 Percentiles: If sample matches population

Expenditures: 99.5 %

Income: 97.0 % 

 Outside sources: If sample differs from 

population

17
20 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

How to Conceal Indirect Identifiers?

 Top-coding: Provide average of 

expenditures above a threshold 

 Re-coding: Change metadata but provide 

numerical data

 Suppression: Delete numerical data or 

entire record

20
21 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

How do we Recode?

 Find metadata that meet criteria

 Determine method: 

 Generalize

 Change

 Replace original metadata with recoded 

metadata

21
22 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Re-coding: Generalize Information

 Broaden production year of cars

From Toyota 

Corolla 1999 

To Toyota 

Corolla 1990s 

22
23 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Re-coding: Change information

 Change states to comparable states

 Change Delaware 

to New Jersey

23

Delaware

New Jersey

Hi
24 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

How to Conceal Indirect Identifiers?

 Top-coding: Provide average of 

expenditures above a threshold 

 Re-coding: Change metadata but 

provide numerical data

 Suppression: Delete numerical data or 

entire record

24
25 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Suppression

 Erase numerical data and 

leave metadata

 Blank out numerical values of 

infrequent purchases

 Example: Boat purchase

25
26 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Suppression

 Complete eradication of 

numerical and metadata

 Erase entire record

 Example: Airplane purchase

26
27 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Reverse Engineering

5 = 3 + X 

27

What’s X?
28 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

How to Prevent Reverse Engineering?

Prevent users to deduce protected 

information from available data

1. Find protected values

2. Protect them in all locations 

3. Protect related values 

28
29 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Reverse Engineering

 Scenarios

 Within file

 Across files

29
30 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Reverse Engineering: 

Within File

 Income = Wages + taxes 

 1000 = 800 + 200

 1000 = 750 + 200

 950 = 750 + 200 

 Critical value: 700 

 Topcode value: 750

30

Wages 

exceeds 

the critical 

value
31 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Reverse Engineering: 

Within File

 Income = Wages + taxes 

 1000 = 800 + 200

 1000 = 750 + 200

 950 = 750 + 200 

 Critical value: 700 

 Topcode value: 750

31

Wages 

match 

the critical 

value
32 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Reverse Engineering: 

Within File

 Income = Wages + taxes 

 1000 = 800 + 200

 1000 = 750 + 200

 950 = 750 + 200 

 Critical value: 700 

 Topcode value: 750

32

Wages 

and taxes 

match 

the 

income
33 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Reverse Engineering: 

Across Files

 Income: Topcoded income in FMLI 

=> Topcode associated UCCs in ITBI 

 Expenditure: Topcoded expenditures in 

EXPN and FMLI 

=> Topcode associated UCCs in MTBI

33
34 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

How Do We Document?

 Flag values

T: Topcoded value 

D: Valid value

34
35 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Impact of topcoding

 CE topcodes few observations

 Most affected data slices:

Geographic data non-self representing cities

Income for high earners. 

35
36 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Impact of Suppression of 

Geographic variables, Percent

 Almost 60 % of 

PSUs suppressed

 Below 15 % of 

states, divisions, 

and regions 

suppressed 4.7

9.8 11.5

58.0

0

10

20

30

40

50

60

70

Region Division State PSU

Source: FMLI and FMLD files for 2015. 
37 — U.S. BUREAU OF LABOR STATISTICS TATISTICS • bls.gov bls.gov

Additional Information

 Protection of respondent confidentiality

provides additional information on 

protecting the confidentiality of 

respondents.

37
38 — U.S. BUREAU OF LABOR STATISTICS • bls.gov

Thank You!

Aaron Cobet

Senior Economist

Consumer Expenditure Surveys

(202)-691-5018

Cobet.Aaron@bls.gov

38