1. Treatment of statistical confidentiality Introductory course Trainer: Felix Ritchie
CONTRACTOR IS ACTING UNDER A FRAMEWORK CONTRACT CONCLUDED WITH THE COMMISSION

2. Before we begin…
Who are we, and why are we here?

3. Aims and objectives: general
Overall objective: to disseminate basic knowledge in methods of statistical disclosure control (SDC) and the considerations involved when applying these methods to real-world data.
Pedagogical model: understanding what and why is more important than how at this stage
This course should equip students with the skills to evaluate, take decisions on and recommend to others confidentiality protection methods to be employed in Eurostat’s work.
It is not designed to make you an expert in specific technical areas. There is an enormous literature on technical aspects of SDC, including the Eurostat-sponsored manual (2010) which is full of extensive technical and methodological discussions. This course simplifies and summarises those findings.
It is designed to give you the confidence to make decisions and challenge the decisions of others, based on a solid understanding of principles.
This course is based on the trainer’s twelve years experience (with the help and advice of many others) designing ways to make confidentiality protection meaningful to people who previously only saw it as a another box to tick. The conceptual approach differs from traditional confidentiality courses which focus on technical skills, but is increasingly accepted as best practice (including by Eurostat).

4. Aims and objectives: specific
At the end of the course students should be able to:
identify confidentiality risks in different contexts
specify risk scenarios, evaluating the appropriateness of alternative approaches to specific situations
understand the main problems in SDC on inputs and outputs
understand advantages and disadvantages of some specific different SDC methods
understand the role of confidentiality protection in the European Statistical System
understand the role of the Argus programs
This course will concentrate on an understanding of
confidentiality protection principles
operational processes
the relative value of different approaches
The most important objective is understanding why.
The advanced courses run by Eurostat provide detailed technical knowledge of the Argus programs, SAS code and other technical tools. After this course, we also hope that you will feel comfortable talking to technical specialists from universities, for example.

5. Target audience
This course is designed for staff working with confidential data who need to have a basic knowledge of
confidentiality measures
methods of statistical disclosure control (SDC)
the considerations involved when applying these methods to real-world data
We assume a basic level of maths and statistics, and familiarity with Excel
Technical requirements for the course are low – for reasons which will become clear, advanced statistical models rarely generate confidentiality risks, and the way to identify those risks is mostly the same as for simple tables.

6. Course outline Principles of statistical confidentiality protection
concepts in data protection and statistical disclosure control (SDC)
data issues
relevance to European statistics
Tabular data protection
Non-tabular outputs
Protecting microdata
Thinking about data protection
This course covers four key topics:
Principles, covering: taxonomy of SDC, including issues such as identity and disclosure; using the ‚Five Safes‘ framework for assessing risk and solutions; distinguishing between legal and practical definitions; principles-based output SDC; the impact of different types of data on confidentiality decisions. The ‚Five Safes‘ framework will be used to explore alternatives to restrictng data quality
Tabular data: this is likely to be the most common output of EC units and so we will spend some time on this. It is also the easiest way to explore many of the specific concepts of SDC, such as primary and secondary disclosure. We will also explore how we deal with tables in inputs. We mainly use simple numerical examples studied as a group. We will also look at a specialist tabular protection tool, tau-Argus
Non-tabular outputs: we will explore principles-based output SDC further, and explore the concept of ‚safe‘ and ‚unsafe‘ statistics; and we will show how dealing with tables fits within a general framework designed to deal with all types of output; we will then see how the simple ‚rules‘ introduced in the first part should be seen as a specific instances of a more general approach
Microdata: we will consider how microdatasets can be used safely, and briefly introduce the automatic tool mu-Argus
We will finish by reviewing how we think abotu data protection; this will bring many of hte themes of the course back together.

7. Warning! All the data used in the course is invented:
all the numbers used in this course are invented
any statements about countries, companies, individuals are invented
all parameters used in assessing confidentiality are for illustration only
Eurostat has guidelines on specific thresholds to be used in practice
A reminder: all the examples here use invented numbers for illustration, so do not read anything into them.
In your work, you will be told what are the relevant thresholds et cetera (they may be specific to countries); the Methodology Division at Eurostat can provide formal information on ESS parameters.
Avoid discussing specific confidentiality parameters
if you have to discuss in public, try to be general or over-cautious
never base an SDC plan on the assumption that parameters are kept hidden – they will almost certainly leak out at some time

8. Questions?
CONTRACTOR IS ACTING UNDER A FRAMEWORK CONTRACT CONCLUDED WITH THE COMMISSION