Dealing with confidential data Introductory course Trainer: Felix Ritchie CONTRACTOR IS ACTING UNDER A FRAMEWORK CONTRACT CONCLUDED WITH THE COMMISSION

Before we begin… Who are you, and why are you here? Why am I here?

Aims and objectives: general Overall objective: to disseminate basic knowledge in methods of statistical disclosure control (SDC) and the considerations involved when applying these methods to real-world data. Pedagogical model: understanding what and why is more important than how at this stage This course should equip students with the skills to evaluate, take decisions on and recommend to others confidentiality protection methods to be employed in Eurostat’s work. It is not designed to make you an expert in specific technical areas. There is an enormous literature on technical aspects of SDC, including the Eurostat-sponsored manual (2010) which is full of extensive technical and methodological discussions. This course simplifies and summarises those findings. It is designed to give you the confidence to make decisions and challenge the decisions of others, based on a solid understanding of principles. This course is based on the trainer’s ten years experience (with the help of many others) designing ways to make confidentiality protection meaningful to people who previously only saw it as a another box to tick. The conceptual approach differs from traditional confidentiality courses which focus on technical skills, but is increasingly accepted as best practice (including by Eurostat).

Aims and objectives: specific At the end of the course students should be able to: understand the role of confidentiality protection in the European Statistical System identify confidentiality risks in different contexts specify risk scenarios, evaluating the appropriateness of alternative approaches to specific situations understand the main problems in SDC on inputs and outputs understand advantages and disadvantages of some specific different SDC methods understand the role and functionality of the Argus programs This course will concentrate on an understanding of confidentiality protection principles operational processes the relative value of different approaches The most important objective is understanding why. The advanced courses later in the year will provide detailed technical knowledge of the Argus programs and SAS code.

Target audience This course is designed for staff working with confidential data who need to have a basic knowledge of confidentiality measures methods of statistical disclosure control (SDC) the considerations involved when applying these methods to real-world data We assume a basic level of maths and statistics, and familiarity with Excel Technical requirements for the course are low – for reasons which will become clear, advanced statistical models rarely generate confidentiality risks, and the way to identify those risks is mostly the same as for simple tables.

Course outline Principles of statistical confidentiality protection concepts in data protection and statistical disclosure control (SDC) data issues relevance to the ESS Tabular data protection Non-tabular outputs Protecting microdata This course covers four key topics: Principles, covering: taxonomy of SDC, including issues such as identity and disclosure; using the ‚Five Safes‘ framework for assessing risk and solutions; distinguishing between legal and practical definitions; principles-based output SDC; the impact of different types of data on confidentiality decisions. The ‚Five Safes‘ framework will be used to explore alternatives to restrictng data quality Tabular data: this is likely to be the most common output of Eurostat and so we will spend some time on this. It is also the easiest way to explore many of the specific concepts of SDC, such as primary and secondary disclosure. We will also explore how we deal with tables in inputs. We will use a mixture of paper examples and exercises using Excel. We will also look at a specialist tabular protection tool, tau-Argus Non-tabular outputs: we will explore principles-based output SDC further, and explore the concept of ‚safe‘ and ‚unsafe‘ statistics; we will show how dealing with tables fits within a general framework designed to deal with all types of output; and we will discuss how the simple ‚rules‘ introduced in the first part should be seen as a specific instances of a more general approach Microdata: we will consider how microdatasets can be used safely, and briefly introduce the automatic tool mu-Argus

Warning! All the data used in the course is invented: all the numbers used in this course are invented any statements about countries, companies, individuals are invented all parameters used in assessing confidentiality are for illustration only Eurostat has guidelines on specific thresholds to be used in practice A reminder: all the examples here use invented numbers for illustration, so do not read anything into them. Within Eurostat, you will be told what are the relevant thresholds et cetera (they may be specific to countries); the Methodology Division will provide this information Avoid discussing specific confidentiality parameters if you have to discuss in public, try to be general or over-cautious never base an SDC plan on the assumption that parameters are kept hidden – they will almost certainly leak out at some time

Questions? CONTRACTOR IS ACTING UNDER A FRAMEWORK CONTRACT CONCLUDED WITH THE COMMISSION