Affiliations: [a] Institute for Production, Cologne University of Technology, Arts and Sciences, 50679 Cologne, Germany | [b] Department of Statistics, Technical University of Dortmund, 44221 Dortmund, Germany | [c] Dombaumeister-Schneider-Strasse 24, 55128 Mainz, Germany
Correspondence:
[*]
Corresponding author: Rainer Lenz, Institute for Production, Cologne University of Technology, Arts and Sciences, Betzdorfer Str. 2, 50679 Cologne, Germany. Tel.: +49 221 82754236; Fax: +49 221 82752322; E-mail: rainer.lenz@th-koeln.de.
Abstract: As part of statistical disclosure control National Statistical Offices can only deliver confidential data being sufficiently protected meeting national legislation. When releasing confidential microdata to users, data holders usually apply what are called anonymisation methods to the data. In order to fulfil the privacy requirements, it is possible to measure the level of privacy of some confidential data file by simulating potential data intrusion scenarios matching publicly or commercially available data with the entire set of confidential data, both sharing a non-empty set of variables (quasi-identifiers). According to real world microdata, incompatibility between data sets and not unique combinations of quasi-identifiers are very likely. In this situation, it is nearly impossible to decide whether or not two records refer to the same underlying statistical unit. Even a successful assignment of records may be a fruitless disclosure attempt, if a rationale data intruder would keep distance from that match. The paper lines out that disclosure risks estimated thus far are overrated in the sense that revealed information is always a combination of both, systematically derived results and non-negligible random assignment.
Keywords: Statistical disclosure control, random assignment, data release, scientific-use-file
