1. Dealing with confidential data Introductory course Trainer: Felix Ritchie
CONTRACTOR IS ACTING UNDER A FRAMEWORK CONTRACT CONCLUDED WITH THE COMMISSION

2. Before we begin…
Who are you, and why are you here?
Why am I here?

3. Aims and objectives: general
Overall objective: to disseminate basic knowledge in methods of statistical disclosure control (SDC) and the considerations involved when applying these methods to real-world data.
Pedagogical model: understanding what and why is more important than how at this stage
This course should equip students with the skills to evaluate, take decisions on and recommend to others confidentiality protection methods to be employed in Eurostat’s work.
It is not designed to make you an expert in specific technical areas. There is an enormous literature on technical aspects of SDC, including the Eurostat-sponsored manual (2010) which is full of extensive technical and methodological discussions. This course simplifies and summarises those findings.
It is designed to give you the confidence to make decisions and challenge the decisions of others, based on a solid understanding of principles.
This course is based on the trainer’s ten years experience (with the help of many others) designing ways to make confidentiality protection meaningful to people who previously only saw it as a another box to tick. The conceptual approach differs from traditional confidentiality courses which focus on technical skills, but is increasingly accepted as best practice (including by Eurostat).

4. Aims and objectives: specific
At the end of the course students should be able to:
understand the role of confidentiality protection in the European Statistical System
identify confidentiality risks in different contexts
specify risk scenarios, evaluating the appropriateness of alternative approaches to specific situations
understand the main problems in SDC on inputs and outputs
understand advantages and disadvantages of some specific different SDC methods
understand the role and functionality of the Argus programs
This course will concentrate on an understanding of
confidentiality protection principles
operational processes
the relative value of different approaches
The most important objective is understanding why.
The advanced courses later in the year will provide detailed technical knowledge of the Argus programs and SAS code.

5. Target audience
This course is designed for staff working with confidential data who need to have a basic knowledge of
confidentiality measures
methods of statistical disclosure control (SDC)
the considerations involved when applying these methods to real-world data
We assume a basic level of maths and statistics, and familiarity with Excel
Technical requirements for the course are low – for reasons which will become clear, advanced statistical models rarely generate confidentiality risks, and the way to identify those risks is mostly the same as for simple tables.

6. Course outline Principles of statistical confidentiality protection
concepts in data protection and statistical disclosure control (SDC)
data issues
relevance to the ESS
Tabular data protection
Non-tabular outputs
Protecting microdata
This course covers four key topics:
Principles, covering: taxonomy of SDC, including issues such as identity and disclosure; using the ‚Five Safes‘ framework for assessing risk and solutions; distinguishing between legal and practical definitions; principles-based output SDC; the impact of different types of data on confidentiality decisions. The ‚Five Safes‘ framework will be used to explore alternatives to restrictng data quality
Tabular data: this is likely to be the most common output of Eurostat and so we will spend some time on this. It is also the easiest way to explore many of the specific concepts of SDC, such as primary and secondary disclosure. We will also explore how we deal with tables in inputs. We will use a mixture of paper examples and exercises using Excel. We will also look at a specialist tabular protection tool, tau-Argus
Non-tabular outputs: we will explore principles-based output SDC further, and explore the concept of ‚safe‘ and ‚unsafe‘ statistics; we will show how dealing with tables fits within a general framework designed to deal with all types of output; and we will discuss how the simple ‚rules‘ introduced in the first part should be seen as a specific instances of a more general approach
Microdata: we will consider how microdatasets can be used safely, and briefly introduce the automatic tool mu-Argus

7. Warning! All the data used in the course is invented:
all the numbers used in this course are invented
any statements about countries, companies, individuals are invented
all parameters used in assessing confidentiality are for illustration only
Eurostat has guidelines on specific thresholds to be used in practice
A reminder: all the examples here use invented numbers for illustration, so do not read anything into them.
Within Eurostat, you will be told what are the relevant thresholds et cetera (they may be specific to countries); the Methodology Division will provide this information
Avoid discussing specific confidentiality parameters
if you have to discuss in public, try to be general or over-cautious
never base an SDC plan on the assumption that parameters are kept hidden – they will almost certainly leak out at some time

8. Questions?
CONTRACTOR IS ACTING UNDER A FRAMEWORK CONTRACT CONCLUDED WITH THE COMMISSION