Integer and combinatorial optimization
Integer and combinatorial optimization
Extending Cell Suppression to Protect Tabular Data against Several Attackers
Inference Control in Statistical Databases, From Theory to Practice
Practical Bilevel Optimization: Algorithms and Applications (Nonconvex Optimization and Its Applications)
Harmonizing table protection: results of a study
PSD'06 Proceedings of the 2006 CENEX-SDC project international conference on Privacy in Statistical Databases
PSD'06 Proceedings of the 2006 CENEX-SDC project international conference on Privacy in Statistical Databases
| Hi-index | 0.00 |
Statistical agencies have to ensure that respondents' private information cannot be revealed from the tables they release. A well-known protection method is cell suppression, where values that provide too much information are left out from the table to be published. In a first step, sensitive cell values are suppressed. This is called primary suppression. In a second step, other values are suppressed as well to exclude that primarily suppressed values can be re-calculated from the values published in the table. This second step is called secondary cell suppression. In this article we explain that the problem of checking whether a pattern of secondary cell suppressions is safe for release or not is generally described in a slightly inconsistent way in the literature. We illustrate with examples that the criteria that are often applied to judge whether a table can be safely published or not do not always give satisfactory results. Furthermore, we present a new criterion and explore some of its consequences. The new criterion is an extension of the well-known (p,q)-prior-posterior rule. This extension is for aggregations of suppressed cells for which a value can be derived from the table. Finally, we provide a method to apply the new criterion in practice.