Expert Meeting on Statistical Data Confidentiality

We implement a synthetic data generation framework on a pseudonymized subset of the 2021 Census data for Luxembourg. Focusing on seven categorical variables—including ordered age and education—we drop unique records upfront to mitigate the risk of singling out. Synthetic data are produced via the CART method in the synthpop package. Utility is measured using the propensity score mean-squared error metrics and regression analyses, confirming that key statistical relationships are retained. In addition, privacy is further reinforced by aggregating numerical values (e.g., grouping ages) in combination with the inherent randomness of the data generation process, thereby mitigating disclosure risks related to linkability and inference. By addressing the three core EU guidance concerns—singling out, linkability, and inference—our methodology meets standards for anonymization and statistical disclosure control, keeping disclosure risk minimal while maintaining data utility. In this presentation, we present our approach and highlight lessons learned.

Disseminating synthetic data enables easy access to data that retains statistical similarities to the original data if access to sensitive data is restricted. However, the model employed when generating the synthetic data may influence the structure of the data, potentially affecting subsequent predictive analysis. This paper empirically investigates whether the choice of synthesis model impacts the performance of predictive models trained on synthetic data.
Each synthesis model is used to generate synthetic data, which is subsequently analyzed using predictive models of the same type. We empirically evaluate, whether the choice of the synthesis model influences the performance of the predictive models. For example, CART prediction models might perform systematically better on synthetic data generated using CART models than they perform on the original data. We evaluate this hypothesis based on extensive simulations and real data applications.

The demand for georeferenced data is increasing, while sharing proprietary location data poses privacy and confidentiality challenges. This study investigates the use of synthetic data generators (SDGs) to protect sensitive locations in georeferenced datasets. We propose transforming spatial coordinates into a one-dimensional index via a Hilbert space-filling curve, thereby preserving local spatial relationships while enabling conventional synthesizers (e.g., synthpop) to synthesize the condensed representation. We evaluate this approach against direct synthesis of latitude and longitude as numeric variables, using disclosure risk measures (re-identification rate) and spatial utility metrics (Average Nearest Neighbor (ANN) index and join count statistic). In a use case with simulated georeferenced health data related to sleep disorders, the Hilbert-based approach underperformed the direct synthesis baseline with respect to both re-identification risk and preservation of spatial relationships. We discuss possible causes for this result and outline limitations of Hilbert-based mapping.

The Trusted Research Environment (TRE, or Research Data Environment, RDC) has been the great success story of data access this century. By providing highly secure yet flexible access, the TRE has enabled research use of the most sensitive data. In its turn the development of the TRE has led to significant developments in research data governance, particularly output disclosure control. The TRE is the sexy new future of data access.

And yet it is the Scientific Use File (SUF) that remains the workhorse of academic research. SUFs are files made available under licence to authorised users, to hold and analyse on their own machines. These are valuable assets to researchers who do not need the detail in TRE data; moreover, they are accessible to users who would not normally be granted access to TREs, such as undergraduate students or non-academic researchers. For the UK Data Archive, which provides both SUFs for download and more detailed files in a TRE, the volume of use of SUFs far exceeds that of the TRE.

However, there have been concerns about the future of the SUF. A methodological review of confidentiality protection suggested that new technologies and methods (such as large-scale computing and AI, combined with social media availability) can reverse engineer any de-identification techniques. An international conference on microdata access suggested that SUFs have a limited future; the head of a major data archive has made similar comments. It has been suggested that, if de-identification techniques are no longer robust, then all personal research data should only be available through TREs.

This would post significant challenges to the research and data services communities. First, there is a significant increase in administrative burden for all parties. Second, there is a resource cost to data services of supporting TRE analysis. Third, TRE access is not available to all those who cannot manage the increased administrative burden. Finally, the logic of this argument is not just that SUFs are untenable, but that all ‘anonymised’ data is ultimately either identifiable or of such low specificity as to lose any research value.

This position holds only as long as the argument is limited to the risks to personal privacy. Less often considered, but equally important, is the offsetting benefit to the public of making such data available. Without considering both sides of the equation, arguments about confidentiality risk have little validity.

This paper re-examines the balance between risk and utility in the light of recent developments in theory (on solidarity in public life) and empirical evidence (on the public acceptability of small levels of risk for research benefit) using the 5 Safes framework to guide us. This strengthens the need to take a balanced view, but we argue that there is a significant gap in our understanding of how confidentiality risk is viewed by the public.

Differential privacy (DP) has become the de facto data protection mechanism due to its strong privacy guarantees. The mathematical foundation of $\epsilon$-DP is based on the principle that the presence or absence of any record in a data set should not influence the protected result by more than an exponential factor determined by the parameter $\epsilon$. Even though DP was originally designed for interactive settings, where the DP masking mechanism acts as an intermediary between users making statistical queries and a remote database providing responses, DP has attracted the interest of researchers and practitioners in many areas, including data analytics, statistics, and machine learning. However, a significant drawback of DP is the severe reduction in utility of the protected outcomes it often entails, an issue that has limited its applicability to real-world scenarios.
To assess the suitability of DP as a practical solution, we conducted an in-depth critical analysis of real-world DP deployments by top-tier companies and institutions in the last 10 years. Our analysis reveals significant issues in most applications, such as weak or unsafe privacy parameters used across the board in an attempt to keep protected data reasonably useful, inaccurate assessment of the attained privacy guarantees, or significant implementation challenges in large-scale scenarios. This limits its applicability for scenarios different from the--quite specific--ones DP was designed for, that is, protecting aggregated responses.
We conclude that, despite the considerable evolution that DP has undergone over the years, in most real-world use cases apart from the interactive setting, DP is far from offering a definitive solution to all privacy challenges due to its limitations and complexity. For continuous private data collection scenarios, DP has the drawback of cumulative privacy degradation over time, while for data releases, DP cannot deliver acceptable utility without compromising privacy based on its foundational principles, especially at the individual level, where large global sensitivities are associated with detailed data.

Teaching versions of datasets are an important component of the data discovery pipeline. These datasets often serve as an introduction to the data for potential users, allowing them to explore the data and assess the relevance of a dataset to their needs. However, in cases where source data is only available in restricted settings, such as trusted research environments (TREs), then capacity to produce such datasets is limited.
Responding to this challenge, this paper reports on a project which has developed software that produces synthetic datasets tailored for specific teaching purposes by utilising already cleared (and published) analytical outputs as the basis for synthesis without access to the original data. Unlike generic synthetic datasets, the datasets created are designed to solely reproduce the specific outputs. The software, which is available as an open access app, is described and three case study examples are presented. Issues arising such as marginal disclosure risk are then discussed as are other possible use cases of the software.

This contribution addresses the intersection of statistical disclosure control and the special requirements of psychological research. Exemplarily, we show the unique sensitivity and complexity of empirical data from psychological research and the problems and possibilities to anonymize them.

The replication crisis in psychology (Open Science Collaboration, 2015; Camerer et al., 2018) has highlighted the need for open science practices that prioritize transparency and reproducibility. However, the open and even the restricted sharing of psychological research data presents significant challenges due to their inherently sensitive nature. Psychological datasets frequently contain personal and confidential information, such as assessments of personality traits, personal interests inventories, IQ tests, ability and aptitude tests, attitude scales, as well as clinical data related to mental health conditions. Preserving the privacy of study participants and ensuring the confidential handling of data are, therefore, critical aspects of psychological research. The application of statistical disclosure methods is one of the most cost-effective and efficient ways of preserving the privacy of individuals compared to privacy-preserving computation methods (Templ & Sariyar, 2022). However, awareness and utilization of anonymization methods within the field of psychology remain limited. Furthermore, psychological research frequently employs complex data structures, such as longitudinal datasets that capture changes over time (Arseneault et al., 2023), hierarchical data that encompass nested relationships, and scales that comprise multiple sets of sensitive items. These characteristics complicate effective anonymization, creating an intricate balance between preserving data utility for scientific inquiry and ensuring participant privacy. Addressing these challenges requires researchers to possess the necessary methodological expertise in advanced anonymization techniques to publish data securely. This contribution addresses the intersection of statistical disclosure control and the special requirements of psychological research. Exemplarily, we show the unique sensitivity and complexity of empirical data from psychological research and the problems and possibilities to anonymize them. The procedures and methods are illustrated using the R package sdcMicro (Templ, Kowarik, & Meindl, 2015). Keywords— Psychology, Open Science, Anonymization, Statistical Disclosure Control References Arseneault, L., Bolivar, M., Bryan, B., Canning, T., Evans, E., Gatera, G., ... Yu, D. (2023). Landscaping international longitudinal datasets: Full report. Retrieved from https://www.landscaping-longitudinal-research.com/what-we-found (Accessed: 26 March 2025) Camerer, C. F., Dreber, A., Holzmeister, F., Ho, T.-H., Huber, J., Johannesson, M., ... Wu, H. (2018). Evaluating the replicability of social science experiments in Nature and Science between 2010 and 2015. Nature Human Behaviour, 2(9), 637–644. doi: 10.1038/s41562-018-0399-z Open Science Collaboration. (2015). Estimating the reproducibility of psychological science. Science, 349(6251). doi: 10.1126/science.aac4716 Templ, M., Kowarik, A., & Meindl, B. (2015). Statistical disclosure control for micro-data using the R package sdcMicro. Journal of Statistical Software, 67(4), 1–36. doi: 10.18637/jss.v067.i04 Templ, M., & Sariyar, M. (2022). A systematic overview on methods to protect sensitive data provided for various analyses. International Journal of Information Security, 21(6), 1233–1246. doi: 10.1007/s10207-022-00607-5

When evaluating the scientific worth of microdata, formally anonymized data provides maximum research potential. But this data can only be accessed onsite via Remote Execution or Safe Centers which offers little convenience for data users. In contrast, factual anonymized data can be accessed from the institutional workspace (offsite access, e. g. Scientific Use Files; SUFs) but offer less analytic potential due to the stricter anonymization methods, such as coarsening, removal of information, etc. In this conflict between analytic potential and the need for anonymization, Remote Desktop represents a bridge between onsite and offsite access for scientists. The Research Data Centers of the German Statistical Offices of the Federation and the Federal States recently introduced Remote SUFs as a step towards the junction of user satisfaction and data confidentiality: Remote Desktop allows comfortable use of microdata with more analytic potential than offsite SUFs from an approved institutional workspace (restricted by technical and organizational data protection measures). At the same time, anonymization methods are applied more strictly compared to onsite data but less strictly than in offsite SUFs. However, there is still a need for further research on finding the “sweet spot” concerning the extent of anonymization applied.

Established methods, such as variable removal or coarsening variables, often fail to attain factual anonymity when spatial or sensitive microdata is to be provided and analyzed. As traditional methods appear exhausted, data synthesis may represent a promising alternative/supplementary anonymization method. CART-based partial data synthesis seems to be a promising method to reach factual anonymity and to enable researchers to analyze Remote SUFs enriched with these spatial or sensitive variables. The present research aims to use CART-based partial data synthesis as an additional anonymization method to generate an enhanced Remote SUF for the German microcensus 2019. Subsequently, the potential increase in utility and loss of privacy are investigated compared to the already published Remote SUF for the microcensus 2019, for which traditional methods of data anonymization were used. In addition to already established metrics for evaluating utility and risk, newly proposed metrics for risk assessment are additionally applied (Raab et al., 2024).

Statistical institutes face a major challenge when transitioning from suppressive to perturbative disclosure control methods: how to objectively calibrate protection parameters. While the Cell Key Method (CKM) effectively protects frequency tables by adding controlled noise, selecting optimal parameters remains a serious challenge. We present an evidence-based framework for calibrating CKM's three main parameters through systematic risk-utility trade-off analysis.

Our five-step methodological framework transforms parameter selection from subjective decision to objective process by: (1) defining reasonable parameter search domains; (2) selecting representative calibration datasets; (3) measuring disclosure risk through an estimation of attacker inference probability; (4) assessing utility impact across multiple randomization scenarios; and (5) visualizing risk-utility trade-offs to identify optimal parameter combinations based on institutional risk tolerance.

Experimental results on synthetic datasets show how our approach make the decision easier for the user by identifying the best set of parameters. Implementation at Insee has enabled the transition from suppression-based protection to CKM for public release of frequency tables, increasing data utility while maintaining required confidentiality protection.

Data in tables published for the Swedish R&D survey in the business enterprise sector (BERD) were previously protected by cell suppression to prevent disclosure of sensitive information. In order to avoid cell suppression, key respondents were asked to sign waivers allowing the publication of their data. However, consent was rarely given to disseminate cells where an enterprise’s data potentially could be disclosed. The steps undertaken to ensure confidentiality were extensive, involving multiple staff and requiring a significant amount of time during production. For users, this resulted in the withholding of statistical information, particularly in tables presenting industry-specific data and its combination with other domains of interest. Consequently, the usefulness and relevance of the published statistics on a granular level were reduced despite the efforts made.

To address these challenges, the BERD survey became the first survey at Statistics Sweden to use a perturbative method for disclosure limitation in magnitude tables . The EZS-method, introduced by Evans, Zayatz, and Slanta (1998: Journal of Official Statistics, 14, 537-551), adds noise to microdata to ensure table additivity and preserve links among tables. Each enterprise is assigned random values for the direction and noise factor, which are kept confidential. Perturbed values are calculated as
$$perturbed\ value=original\ value*(1+direction*noise\ factor/100), $$ where both the direction and noise factor are applied to all values reported by the object. The distribution of directions of perturbation is chosen so that it is symmetric around 0 and thus does not introduce any consistent bias. Cells with one object or dominant contributions receive more noise to protect individual data, while noise in cells with many smaller contributions cancels out. The balancing procedure proposed by Massell and Funk (2007: Proceedings of the 2007 Third International Conference on Establishment Surveys (ICES-III), Montreal, Canada) is used to reduce overall noise, applied only to cells without risk of disclosure.

The method was tested on 2021 data from the BERD survey and successfully used for 2023 data published in autumn 2024. It allows for disseminating tables with approximate values without suppressing any cells and is simple to implement without specialized software. The method works well for high-dimensional tables or tables with hierarchies and is more effective than cell suppression.

The package τ-Argus is a widely used EU-funded Open Source tool for disclosure control in tabular data. It is automatable via batch functionality, and as Open Source package it is supposed to be easy to adapt, and transparent. As there is growing demand for specific τ-ARGUS functionalities to be provided “as a service”, the paper will discuss pros and cons of a fundamental revision of the architecture of the package, such as the idea of developing API to allow SDC methods included in τ-ARGUS to be called from “any” language/interface (e.g., Java, Python, R, cloud-based, web-based, …).

The paper will examine this idea and its consequences in some detail. A particular challenge is that API users should be able to run their (exact same) instance also from out of the GUI, for example to get a clue of what went wrong in case of unexpected results. For testing purposes, API users must also be able to check the “correctness” of input data when making calls from other environments in the sense that the GUI would run a particular instance on the exact same input data. “Correctness” in this context refers to the fact that in the original process, parts of the data preparation are implemented in the routines of the τ-ARGUS GUI. With the transition to APIs, this preparation could now be implemented as well in environment systems of individual users, before calling the respective API. We will investigate potential consequences of such requirements on interfaces provided by τ-ARGUS, in the paper.

Another issue the paper will consider is the question of how to better sustain continuous development of the package and its components, ensuring in particular that the package will be able to run with recent/security supported Java versions. Since the most recent Java versions are only available in 64 bit, this means that τ-ARGUS also needs to be upgraded to a 64 bit version. Ideally, there should also be a continually maintained Linux/Unix version, easier to integrate into Linux/Unix production environments. Continuous development should be accompanied by automated testing facilities which would have to be created as well.

Apart from software architecture, other major issues will be discussed as well. For example, the option for a future replacement of the hypercube method for which maintenance has been stopped by its provider by re-implementation of the method. Or to “integrate” another method for secondary cell suppression which, like the hypercube method, is similarly able to deal with extremely large tables (without need of a commercial LP solver), e.g. the package GAUSS [Langsrud, Ø. 2024]. We also briefly report on a current small research cooperation between Destatis and a university, studying options for re-implementation of the algorithm in τ-ARGUS for solving the MILP problems of secondary cell suppression.

In many countries, perturbative methods are increasingly used as a privacy protection method for official statistics. The U.S. Census Bureau has applied the mechanism of differential privacy, specifically Zero-Concentrated Differential Privacy (zCDP) during the creation of statistical tables created based on data from the 2020 Census as well as Privacy-Protected Microdata Files (PPMFs) as a protection against “database reconstruction attacks”.
Several empirical studies on the effectiveness of perturbative methods (such as additive noise, data swapping and PRAM) for Japanese official microdata were conducted by Ito and Murata (2011), Ito and Hoshino (2012, 2013, 2014), and Ito et al. (2017, 2018). Other studies have investigated the possibility of adapting differential privacy for detailed geographical data and statistical data created based on individual data from the Japanese Population Census. Studies were also conducted on the potential of differential privacy as an anonymization method for Japanese statistical data (Ito and Terada (2019) and Ito et al. (2020), Ito et al. (2023)).
This paper conducts a comparative study into the potential of differential privacy for Japanese Population Census data, while reflecting the approaches towards the application of differential privacy to official statistics in other countries, particularly the United States. Specifically, this research conducts an analysis of data utility for statistical tables for which zCDP is applied at different geographical levels, which are created using individual data from the 2020 Japanese Population Census.

The Cell Key Method (CKM) is commonly used by statistics agencies to release tabular data. This paper compares the utility of a new open-source synthetic data tool, SynDiffix, with CKM for very fine-grained geographic data. SynDiffix is designed to have strong anonymity even when used by non-experts, and aims for high accuracy while maintaining strong anonymity. We compare the utility of SynDiffix and CKM for reported income data geocoded to 100x100m grid resolution. We show that, at this resolution, CKM is substantially more accurate than SynDiffix. On the other hand, we find that SynDiffix achieves comparable utility for larger geographic areas. Its flexibility, robustness, and ease-of-use make it more suitable for use cases where end-users can select data features on demand.

The presentation outlines the practical application and evaluation of the targeted record swapping (TRS) method in the context of the 2021 Polish Census (NSP2021), specifically for population data dissemination within a 1 km² grid framework. The method, recommended by Eurostat, was employed to address statistical disclosure control (SDC) requirements while preserving data utility. The talk covers organizational challenges, software issues, and methodological decisions, including the choice of key parameters such as swap rate, risk and similarity variables, and administrative hierarchies. Emphasis is placed on the balance between protecting individual confidentiality (through k-anonymity and l-diversity rules) and maintaining the analytical value of spatial demographic data. The outcomes, accepted by Eurostat, demonstrate the feasibility and effectiveness of TRS under real-world constraints, providing a foundation for further refinement and standardization of this approach in future census rounds.

Limitation of statistical disclosure, while preserving utility and accuracy, by using standard methods is the pragmatic goal for official statistics while differential privacy is regarded as a practical goal for technological institutions which use or even stream data and involve open-source tools and libraries.
In this paper we explore the potential of using Bayesian methods to both estimate and decrease the disclosure risk when publishing official statistical output datasets, e.g. aggregated and/or spatial or survey data.
Bayesian modelling has been already employed in numerous instances for the purpose of:
(i) generating multiple synthetic data sets (Graham and Penny, 2005; Graham et al., 2009; Drechsler and Reiter, 2010, 2012)
(ii) simultaneous detection and correction of errors as well as disclosure limitation for microdata (Kim, Reiter and Karr, 2016)
(iii) differentially private algorithms through posterior sampling (Dimitrakakis etal, 2017)
We however focus on two important directions but less explored:
(i) the risk quantification and the solutions offered by Bayesian formulations for attack scenario and risk assessment
(ii) using non-parametric hierarchical Bayesian models for building a data protection procedure and evaluating the risk (see Battiston and Rimella, 2024, for same type of models)
We illustrate the new approach on a typical case study, i.e. the Icelandic 2021-Census data, comparing the new results with standard solutions like record swapping and cell key method. When regarded through the Census-grid(s), Iceland looks like a “virtual archipelago”, i.e. a large set of disconnected populated cells, many of them with a very small number of inhabitants, separated by large unpopulated areas. This means that even aggregated data for such cell-systems pose a high disclosure risk when published, making it an ideal candidate for data protection.
In addition, we impose several requirements for this data protection strategy, i.e. that it should preserve the relevant distributions over regional (and more, e.g. urban/rural) divisions therefore produce results fitting the public knowledge and that it could be automatically and straightforwardly applied to an arbitrary output dataset.
The open code and results are reported/linked on the repository of open code which already includes the information concerning our project on SDC for the small output area system and preliminary code for the evaluation of new methods.

This article presents recommendations on data sharing written in the framework of the third phase of the G20 Data Gaps Initiative (DGI-3) .
The recommendations were written by the task team led by Eurostat and ECB and bringing together representatives of the 21 countries.
The recommendations comprise amongst others: definitions of terms, general principles of data sharing, modalities of data sharing, elements of data sharing agreements and metadata standards.

The traditional approach to accessing register-based microdata requires researchers to apply for data on a project-by-project basis, a time-consuming process as each application must be manually reviewed and approved before the relevant data can be extracted and handed out.
A more flexible approach is to grant a broader range of researchers from authorized institutions quick access to a secure, microdata-based remote analysis platform where they can conduct their research. In order for such a platform to adhere to the Five Safes framework, it should not directly expose the microdata to users but instead only provide access through a given scripting language. However, this does not fully mitigate the risk, as the output from user queries — especially when executed sequentially and combined — could still be used to infer confidential information in the microdata. Therefore, additional measures are needed to secure the output, ideally with minimal loss of utility.

In this paper, we present the confidentiality measures implemented in the analysis tool microdata.no, a dynamic microdata remote analytics platform providing researchers access to Norwegian register data.
While microdata.no does not display the microdata directly to users, it offers significant flexibility through an expressive scripting language with commands for selecting variables, filtering units, creating, removing or modifying variables, and executing statistical procedures like summarization, tabulation, grouping, and regression. Given the language's high expressivity, additional output safeguards are necessary to prevent disclosure of sensitive information. In line with this goal, we have incorporated automatic output SDC measures in the platform, including, but not limited to, population-based noise on unit counts, suppression of small groups, winsorization, and reduced output precision. These measures minimize distortion for analyses of large populations, which have higher analytical value, while providing greater protection for smaller groups, where the risk of disclosure is greater. To complement the output SDC measures, we have implemented high-level detection mechanisms to examine user-submitted scripts, aiming to identify patterns indicating potential misuse. The insights gained from our work are applicable beyond microdata.no, providing a foundation for implementing similar safeguards in other flexible microdata-based platforms.

National Statistical Offices collect massive volumes of data to fulfill their missions. These data fuel the generation of regional, national, and international statistics across various sectors. However, their immense potential remains largely untapped due to strict and legitimate privacy regulations. In this context, Lomas is a novel open-source platform designed to realize the full potential of the data held by public administrations. It enables authorized users, such as approved researchers and government analysts, to execute algorithms on confidential datasets without directly accessing the data. The Lomas platform is designed to operate within a trusted computing environment, such as governmental IT infrastructure. Authorized users access the platform remotely to submit their algorithms for execution on private datasets. Lomas executes these algorithms without revealing the data to the user and returns the results protected by Differential Privacy, a framework that introduces controlled noise to the results, rendering any attempt to extract identifiable information unreliable. Differential Privacy allows for the mathematical quantification and automatic control of the risk of disclosure while allowing for a complete transparency regarding how data is protected and utilized.

In this presentation, we illustrate how the platform can be used for the secondary use of data in research through a real-world use case in collaboration with a Swiss university. We provide guidance on how we balanced the privacy-utility trade-off to ensure the validity and statistical reproducibility of the research conclusions while offering the strongest possible privacy guarantee.

In this paper, we are trying to address the current issues and challenges of Research Data Centres, using the Hungarian Central Statistical Office’s model, while proposing possible improvements to further enhance efficiency. In order to do so, we are planning to take a three-way standpoint. By that, we mean to take into consideration the viewpoint of SDC Experts, Researchers and the User Relations Department professionals altogether, since it is these three foundations that micro-data driven scientific researches are built upon. The focus will mainly be on SDC control related topics, however, since the whole process isn’t a one-sided act, we will dive into all the actual feedback we got from the aforementioned sides as well. For example, how Researchers need an extended period of time to receive accreditation to access certain datasets. We note that it is important to grant a more precise description with detailed labels about every dataset. Moreover, from an SDC standpoint, while training Researchers to consider data protection during output production can definitely be beneficial, it has its own risks as well. We also go through the difficulties of monitoring a whole research from beginning to finish, especially if there are large time gaps between data releases and if there are additional information outside of the Research Data Centres to consider, too.

The International Network for Exchanging Experience on Statistical Handling of Granular Data (INEXDA) is a collaborative project involving central banks, the ECB, Eurostat, and other international organizations and national statistical institutes, with strong support from the BIS. The primary goal of INEXDA is to facilitate the exchange of experiences related to the statistical handling of granular data for research purposes.

In 2023, INEXDA established a working group to address the issue of Statistical Disclosure Control (SDC). This working group has made significant progress in identifying the current needs, procedures, and tools used by its members. Building on this foundation, the group aims to harmonize SDC practices by proposing common rules for output checking, particularly for cases where the dataset shared with researchers at different access points is the same. Output Checking is a process that ensures that results produced from confidential data do not reveal sensitive information.

To achieve this, the working group has produced a document outlining standardized guidelines and best practices that researchers must follow within the INEXDA framework. The document provides detailed anonymization rules that researchers must follow before releasing their output, recommendations for best practices to ensure reproducibility and compliance with anonymity standards, and guidelines for the publication phase.

Establishing standardized Statistical Disclosure Control (SDC) processes is vital as data-sharing demands increase, anonymization techniques advance, and principles for privacy preservation continue to develop. In response, we present a SDC Architecture to systematically plan, implement, and document SDC of microdata with the objective to improve consistency, transparency, and adaptability in SDC as well as to facilitate institutional learning and compliance.

The SDC Architecture comprises four core layers, reflecting the progression from data acquisition - disclosure control - dissemination - long-term stewardship. Each layer structures decision-making and documentation at a critical stage of the SDC process, addressing diverse implementation contexts. Available in both concise and comprehensive formats, the SDC Architecture addresses methodological, legal, institutional, and technical prerequisites, while accommodating diverse data domains and contextual requirements.

Fully aligned with statistical standards, the SDC Architecture integrates into broader data governance ecosystems, informing both internal workflows and external communication. By serving as a procedural guide and a documentation standard, the SDC Architecture supports reproducibility and comparability, fostering consistent, auditable, and high-quality anonymization practices across evolving legal, technical, and organizational landscapes.

Ensuring secure, efficient, and transparent data-sharing mechanisms is a key challenge for modern public administration, particularly when handling sensitive microdata for policy development and evaluation. The Ministry of Foreign Affairs of the Hellenic Republic (MFA) has implemented an innovative Strategic and Operational Planning (SOP) function, incorporating digital tools and Business Intelligence technologies to enhance data security, confidentiality, and controlled access in accordance with governmental and international frameworks.
This case study presents the MFA’s approach to secure remote data access, particularly in policy-driven microdata management. The MFA has developed a role-based access system, ensuring that microdata used for strategic planning and evaluation are available to authorized stakeholders while maintaining statistical confidentiality. This system allows:
• Controlled remote access to anonymized datasets for policy evaluation.
• Automated confidentiality mechanisms, ensuring sensitive data remains protected.
• A centralized digital platform for intragovernmental data exchange, supporting cooperation among line Ministries of the Hellenic Republic in foreign policy planning.
A key feature of this approach is the use of Business Intelligence reports for data analysis and confidentiality preservation. The MFA has developed a secure environment that enables decision-makers to analyze aggregated data outputs, ensuring both usability and compliance with data protection principles.
The presentation will discuss the technical and organizational challenges of implementing a remote, secure, and transparent data-sharing mechanism within a government entity. Additionally, it will highlight best practices for balancing data accessibility with confidentiality, including lessons learned from data user engagement, emphasizing the trade-off between data security/availability and policy usability.
Greece’s experience provides a scalable model for integrating statistical confidentiality measures into policy-driven microdata management. By sharing insights from the MFA’s SOP function, this contribution aims to inform future discussions on international trans-border data access and secure microdata sharing frameworks.
Keywords: Secure microdata access, confidentiality, remote data sharing, Business Intelligence, policy-driven data management.

The Secure Data Access Center (CASD) platform provides controlled access to sensitive administrative data for research purposes, ensuring strict adherence to confidentiality regulations. Operating in an offline environment, CASD enhances data security by minimizing external vulnerabilities while allowing researchers to access and analyze this data in their secure and totally isolated environment.
To improve research efficiency, CASD is integrating a feature that allows researchers to import small text-based content that could be statistical code, structured datasets , or nomenclature mappings for categorical variables. This capability reduces the need for manual coding tasks and streamlines research workflows. These imports are activated by the researcher themselves, without human intervention by CASD teams.
However, the introduction of text imports raises potential security concerns, particularly in terms of cyber risks such as the possibility of injecting hidden scripts or binaries that could exploit system vulnerabilities. That being said, these risks are already significantly mitigated by the strict isolation of research environments within CASD and the restricted size of possible imports.
To address these risks, CASD employs a dual-layered control system that evaluates imported content prior to its integration into the secure environment. The first layer utilizes a deterministic, rule-based approach that employs regular expressions and heuristic rules to scan text chunks for recognizable structured formats (e.g., CSV, JSON), as well as binary and code structures. When such content is detected, the system flags it and provides descriptions of the associated potential risks.
The second layer leverages an offline Large Language Model (LLM) to enhance content classification and detect anomalies. Operating in an isolated environment, the LLM analyzes the text to distinguish between scripts, structured data, categorical nomenclature, binary structures, and free text. It also identifies potentially malicious scripts, such as binaries or unknown content, which could pose security risks to the platform. The LLM achieves over 90% accuracy in classification tasks on the training dataset, significantly improving detection capabilities compared to rule-based filtering alone.
This AI-driven analysis significantly improves the platform’s ability to detect subtle confidentiality risks that may not be immediately apparent through rule-based filtering alone.
Finally, the system generates a detailed report for each imported text, documenting the detected features and anomalies. This report facilitates human oversight by providing security personnel with a transparent view of the evaluation process, allowing for manual review and validation of flagged content.

The practice of Output Statistical Disclosure Control has developed largely by consensus, a situation which is being challenged by a number of factors. First of these is the almost Cambrian Explosion in the number and scope of Trusted Research Environments as many domains move away from the ‘download’ model of enabling research. A second challenge is the accompanying proliferation of different forms of outputs requested (including AI models trained on sensitive data). The final driver is a growth in tools for (semi) automated assistance in the OSDC process, which because they arise from different domains, often differ in the types of risks they check for, and the range of mitigations they apply.
In this paper we describe the development of a formal specification of queries, risks, and mitigations. This leverages the taxonomy described in the ‘Statbarn’ framework, but also provides a basis for encompassing the risks posed by machine learning models. This specification has several features that we hope will assist the OSDC community. First, it provides easy-to-understand graphical representations that we hope will spark debate, encourage consensus-building, and be useful for training purposes.
Second, it uses an extension of the W3C ‘Data Privacy Vocabulary’ that means it is both human-readable and machine-actionable. We will describe how this has been used to create a ‘reference implementation’ via a refactoring of the SACRO toolkit.
Third, it creates a rigourous basis for making systematic and grounded comparisons between various OSDC tools (such as Tau/Mu-Argus, SACRO, DataSHIELD etc) and the mitigations offered by various ‘privacy preserving’ technologies.

The Humanitarian Data Exchange (HDX) is an open platform managed by the Centre for Humanitarian Data designed to facilitate the sharing of humanitarian data among organizations and improve decision-making and response efforts in humanitarian crises. As part of its role in managing HDX, the Centre recognizes the various types of sensitive data being collected and used by partners to support humanitarian operations. While humanitarian organizations are not allowed to share personally identifiable information (PII) on HDX, they may upload survey data or multi-needs assessment datasets on the platform that could be sensitive due to the potential risk of re-identifying individuals. In addition, data can be deemed highly sensitive in some contexts (e.g.: active conflict) or countries (e.g.: due to local laws or restrictions), while they are not sensitive in others. To ensure sensitive data is not available on the platform, the HDX team manually reviews every dataset at the time of publication. However, as the platform has grown and the diversity of shared data has increased, detecting potentially sensitive data has become a significant challenge.

In collaboration with researchers at the Centrum Wiskunde & Informatica (CWI), we developed an approach to detect contextually sensitive data in tabular datasets that leverages a multi-stage pipeline architecture powered by large language models (LLMs). The system processes raw tabular data through sequential stages: standardization and metadata extraction, personal data detection using lightweight LLMs, non-personal sensitive data detection using LLMs with retrieval-augmented generation (RAG), and microdata-level sensitivity analysis. This approach allows for automatic detection of sensitivities that considers both the inherent properties of the data as well as contextual information such as geopolitical conditions and Information Sharing Protocols. Key considerations in this implementation include both technical and ethical dimensions. For data protection, we devise both proprietary model APIs (using only table headers and metadata) for maximum accuracy, as well as local models to ensure sensitive data is not sent to third parties. The system is designed to adapt to different humanitarian contexts with high accuracy and is easy to maintain.

Initial experiments demonstrate significant performance improvements over previously used methods in HDX. The LLM-based approach using GPT-4o-mini, without any tuning or examples, already achieves an F1 score of 0.78, substantially outperforming baseline methods including Google Cloud DLP (F1: 0.54-0.56) and Microsoft Presidio (F1: 0.52). The LLM approach also demonstrates superior precision (0.78 vs. 0.39-0.55) and dramatically lower false positive rates (0.047 vs. 0.087-0.219), addressing a key limitation of current tools. Open-source models like Cohere's Aya model show promising results (F1: 0.65-0.70), offering viable options for local deployment. These improvements enable more accurate identification of sensitive information while reducing the burden of manual reviews, ultimately enhancing data protection for vulnerable populations in humanitarian contexts.

Trusted research environments have historically used rounding and thresholding as the recommended disclosure control method for exports of population data. However, within ONS Trusted Research Environments, for some datasets, perturbation is allowed in combination with thresholding. Code has been made available so researchers can create perturbed outputs using a specific level of noise.
This creates a problem: how can export checkers tell if an output has been correctly perturbed? Even with supporting information showing the raw counts, it is not obvious that a researcher has used the right method and parameters to create the perturbed counts for export.
To this end, machine learning methods were trialled on a set of synthetic training data (n=5000). Training data was created using perturbation code so datasets would resemble genuine exports. Five different types were produced, 50% were generated with the ‘correct’ method and parameters. Logistic Regression, XGBoost, Random Forest, K Nearest Neighbours, Naive Bayes and Support Vector Machine models were trained and evaluated.
This paper explores the results and how these models could be applied in the Trusted Research Environment context

In 2023, CASD introduced a system to detect exports that do not comply with statistical secrecy [1]. This approach, based on feature generation from groups of exported files and the training of a boosting model, showed promise but precision could improve. The system relied on historical data from past Statistical Disclosure Control (SDC) expert reviews, where decisions (Accepted/Refused) served as labels, and structured features were extracted from the reviewed exports. The primary goal was to identify situations that could pose a risk to confidential data and trigger alerts for expert review. Additionally, this dataset provided a foundation for data augmentation techniques to enhance model robustness.
An initial improvement to the system involved shifting the compliance prediction from the export level (a group of files) to the individual file level. This refinement allowed the model to be trained on a larger dataset, improving detection accuracy. The transition also necessitated a new approach to file representation and analysis, particularly through the use of structural components.
In this paper, we propose a further enhancement to increase the system’s reliability. By leveraging Large Language Models (LLMs), we introduce new predictive features that enrich the risk rating model. In particular, LLMs enable the detection of key attributes previously missing from the system, such as identifying columns containing headcounts and ensuring compliance with minimum value requirements.
Beyond numerical validation, LLMs also enhance the system’s ability to analyze textual content, determining whether exported data consists of code, structured datasets, or free-text documents. A crucial aspect is assessing the human readability of exported content, ensuring that flagged files can be manually reviewed when necessary. By improving transparency and traceability, this integration strengthens both the reliability and interpretability of statistical secrecy compliance checks.

[1] Rigaud, Titouan, et al. "Checking data outputs from research works: a mixed method with ai and human control." United Nations Economic Commission for Europe (UNECE) Conference of European Statisticians (CES): Expert meeting on Statistical Data Confidentiality. 2023.

ε-Differential privacy (DP) is a popular privacy model that has been promoted as the de facto standard in most data intensive areas. However, the selection of the privacy parameter ε (also called budget) in applications of DP remains an open challenge. Even though the meaning and implications of the value of ε are not fully understood, it is clear that large budget values are less privacy-preserving than small budget values and, since the privacy loss is exponential, when the budget exceeds 4 or 5, DP offers privacy in name only. But so far, it has been accepted that small budget values provide meaningful privacy and, thus, prevent disclosure. In this paper, we challenge this claim. First, we provide a clear and numerically quantifiable interpretation of ε in terms of disclosure. Then, we illustrate how knowledge of the underlying data may allow the adversary to adapt their attack method to result in greater levels of disclosure. We show that, for the same budget value and especially when this budget is small, the disclosure risk varies considerably. Thus, DP cannot offer actual ex ante guarantees against disclosure, no matter the value of ε. We conclude that users should not rely exclusively on the fact that they chose a small budget (or, more generally, on the use of DP), but they should empirically assess the disclosure risks for specific applications, considering both the underlying distribution of the data and the adversarial approach.

This paper evaluates disclosure risk measures for synthetic data generated by CART-based models, using both a controlled simulated dataset and publicly available data. We find that common disclosure risk measures may fail to detect disclosure risks and, in some cases, misrepresent actual disclosure risks. Additionally, CART-based models, while maintaining high statistical utility, may compromise privacy protection. Our findings highlight challenges in measuring disclosure risk of synthetic data and suggest improvements for more accurate risk assessments.

The rise in access to public data on the internet, and specifically online social networks (OSNs), is causing new pressures on the statistical disclosure control of microdata. Currently at Statistics Netherlands, a criterium is applied that looks at three properties of variables: rarity, visibility and searchability. Underlying this criterium are, similar to other methods used to assess the risks in data disclosure, assumptions on the knowledge of the attacker. We assume one is more likely to know information about one's neighbour, rather than an arbitrary person on the other side of the country.

However, OSNs have essentially made all of us virtual neighbours: the information that the average citizen supplies about themselves on the internet is often larger than can be glimpsed from a peek into their window. This wealth of knowledge put online by the public themselves, combined with the emergence of new techniques to gather and analyse this information collectively known as OSINT, leads us to conclude the assumptions made on the attacker knowledge might no longer be accurate.

This paper explores which threats these new methods pose for microdata, how these threaths can be analysed, and what can be done to more accurately include them in our risk analyses. Additionally, we discuss how NSIs could deal with these new developments. Should we let the ever-expanding amount of public data affect the way in which we implement statistical disclosure control - and if so, how?

Government statistical agencies increasingly rely on sensitive tabular data to guide evidence-based policymaking, yet restrictions on data access hinder research and transparency. Synthetic data generated with Generative Adversarial Networks (GANs) offers a promising solution, but conventional GANs often produce unrealistic tables or fail to preserve the statistical relationships that matter most to policymakers. In this paper, we introduce a knowledge-informed GAN framework designed specifically for the needs of statistical agencies. Our approach embeds domain knowledge into the generative process by enforcing statistical constraints, preserving cross-attribute correlations, and leveraging structured priors from probabilistic graphical models. Unlike standard methods, this informed integration ensures that generated data not only mimics distributions but also respects the underlying dependencies inherent in census-like datasets. To safeguard confidentiality, we further extend the model with differential privacy mechanisms. Empirical evaluations on benchmark tabular datasets demonstrate that our method achieves superior trade-offs between utility and privacy. These results suggest that knowledge-informed GANs can provide a practical pathway for agencies to share high-quality synthetic microdata while upholding strong privacy protections.

Recent years have seen an increased pressure to allow information derived from administrative data to be used to inform policy; see for example the Sturrock Report, 2024. Several organisations have been set up in the UK to develop policies to facilitate this. When data access is given to researchers, who are not part of the organisation that owns the data, there is a concern that there may be a disclosure risk that will compromise the privacy of the data subjects, who may be individuals or organisations. The possibility of a breach of confidentiality depends crucially on how the data are to be made available; the options for this are a spectrum from free availability on a web site to highly restricted access, requiring formal applications to access data in a controlled and monitored environment. Many intermediate types of access exist, including those where the data held by the data owner is modified to reduce its disclosure potential. Methods of reducing disclosure risk include statistical disclosure control procedures (sdc) as well as the creation of synthetic versions of the original data.
Metrics to assess disclosure risk are required to evaluate any possible loss of confidentiality, but there is little consensus on how they should be used. Two types of disclosure risk are usually defined
1. Identity disclosure: Learning that an individual or organisation is present in a data set
2. Learning something new about a subject who the person enquiring believes to be in the administrative data
Both of these metrics require the specification of quasi-identifiers (Qis) to define items that an intruder might be expected to know about a subject who is being investigated.
This presentation will review a number of the aspects of such metrics. These include what records they should be applied to, how they should be standardised, and other practical issues of how thresholds for the metrics should be decided. Illustrations will use data that has been subjected to SDC as well as synthetic data.

Introduction: The de-identification of unstructured free-text data is important for sharing large amounts of healthcare information generated by electronic health records, publications and clinical trials. To automate this process, information extraction (IE) and natural language processing (NLP) are essential tools. However, evaluating NLP performance in de-identification requires understanding the types of entities involved and their significance for re-identification. Methods: This paper looks at patient safety narratives from clinical trials from F.Hoffmann-La Roche as a case study of free-text data that would undergo de-identification for public release. The study employs a mixed-methods approach including quantitative text analysis and qualitative content analysis to identify challenges in the use of NLP for de-identification and to build a framework for the impact of different entity types on NLP performance in de-identification. Results: The findings show that clinical trial narratives are dense in patient-level medical information and the weighting of entities for evaluating NLP performance in de-identification depends on the intruder’s background knowledge, although some commonalities exist across different intruder types. The current NLP evaluation metrics don’t translate well to de-identification tasks as some entities are more crucial to remove than others. Qualitative insights suggest that different therapeutic areas may require different de-identification approaches due to the nature of the disclosive information. Notably, psychiatric clinical trial narratives posed significant challenges for NLP due to the complex semantic characteristics of the free-text data. Conclusions: Current NLP evaluation metrics are not well-suited for de-identification tasks. Certain therapeutic areas, such as psychiatry, push the limits of NLP capabilities more than others. Further research is needed to develop robust mathematical equations for evaluating NLP in the context of de-identification.

At Statistics Norway, the methodology department is responsible for the internal education of staff. Traditionally, SDC training has been offered on demand, with courses held at most once a year. For a statistician who is newly employed or interested in applying a new SDC method, waiting up to a year for training is both impractical and unproductive. In addition, Statistics Norway has introduced several new general guidelines and rules for SDC over the past two years. It has thus been important to spread the news and inform the statisticians about these new guidelines, and not least, the rationale behind them. To meet these new demands, the methodology department has investigated new communication channels for educational training and SDC awareness as a supplement to the traditional yearly courses. We have produced several short tutorial videos aimed at teaching the statisticians the new guidelines and explaining basic concepts of SDC. In addition, we have initiated a weekly drop-in hour where statisticians can show up without an appointment to ask questions, discuss methodology, or get hands-on help. In this talk, we will share our experiences with these new strategies and lessons learned. We will also share which topics we have selected to include in our tutorials. Additionally, we will present some ideas for future work, including potential new topics and formats for training.

National Statistical Offices (NSOs) are pivotal in producing data essential for analyzing sociodemographic and economic trends. Most national statistical laws enshrine the confidentiality of collected data to safeguard citizens’ privacy. Yet, these laws frequently lack specific, actionable measures to enforce this principle. Consequently, supplementary normative frameworks are critical to establish clear, practical guidelines that enable NSOs to uphold statistical confidentiality effectively.

Mexico offers a compelling example through its 2021 Policy for the Management of Confidentiality in Statistical and Geographical Information. This study examines Mexico’s approach to crafting this regulation, detailing its key conceptual foundations, structural design considerations, and the collaborative process of stakeholder consensus-building. Furthermore, it explores the critical factors that supported the policy’s adoption, implementation, and ongoing evaluation, ensuring its practical applicability.

This presentation aims to distill valuable insights for other NSOs yet to develop comparable frameworks. A well-defined normative document not only strengthens statistical confidentiality practices but also enhances public trust and confidence in official statistics. Mexico’s experience underscores the importance of context-specific regulations that strike a balance between data utility and privacy protection, offering a model for advancing global standards in statistical governance.

To reflect key advances in statistical disclosure control (SDC), we present a revised and unified version of the World Bank’s microdata anonymization guides. The World Bank previously published three separate guides: one on SDC theory and two practice guides for implementing microdata anonymization using the R package sdcMicro, both via command line and the sdcApp GUI. These guides have been widely used by practitioners in national statistical offices (NSOs), international organizations, NGOs, and the private sector, forming the foundation for training and technical assistance initiatives.

Since their initial publication, the field of SDC has evolved. This revised guide incorporates methodological updates, including differential privacy, updates all code and screenshots to reflect changes in sdcMicro and sdcApp, and introduces a new reproducible case study based on a fully synthetic population dataset for training purposes. It also integrates insights from real-world implementations by NSOs in low- and middle-income countries (LMICs), bridging the gap between theory and practice.

Additionally, the three guides are now consolidated into a single resource, replacing ReadTheDocs with Quarto and hosting the guide on the World Bank website. This new structure enhances usability, simplifies navigation, and ensures consistency. The revised guide provides a comprehensive, practical resource for SDC practitioners, combining theoretical foundations with applied guidance rooted in real-world experience.

Synthetic data is often hailed as the future of safe data access – but in practice, it is insufficient for a method to be mathematically private or analytically useful: if legal and privacy teams do not understand the guarantees, they cannot confidently allow its use. This creates a critical but underexplored tension between cutting-edge privacy techniques and real-world operational requirements: the need for explainability.

The UK’s Office for National Statistics (ONS) have overcome this challenge and present a generalisable framework for productionalising high-fidelity, privacy-preserving synthetic data, designed to meet the UK’s legal and regulatory standards – including UK GDPR and the Statistics and Registration Service Act 2007 – while remaining explainable to non-technical stakeholders.

The framework is built around an adapted version of the MST (Maximum Spanning Tree) method, a state-of-the-art approach to differentially private data synthesis. We demonstrate how we made technical adaptations to MST to allow stakeholder involvement from the outset, and how we reframed key parameter choices such as $(\epsilon,\, \delta)$ in terms of familiar disclosure controls such as cell suppression.

We illustrate this framework in the setting of the generation of an $\epsilon = 1$ differentially-private synthetic linked census and death register data set, providing robust measures of utility of the data, alongside insights into how the ONS are now using this data to enable cross-government data sharing.

With the need for deeper analysis and more granular data, statistical offices must place a greater focus on measures to mitigate the risks of statistical data disclosure. There can, however, be tensions between users who require granular data and the need for statistical offices not to disclose information of the data subjects.

However, this tension may not be most obvious to some user groups, and statistical officers may struggle to effectively navigate this when applying methods aimed at reducing disclosure risks for the various groups of data users and the specific circumstances involved. National statistical offices can thus take a practical approach by combining both promotion (education) and prevention (methods applied to statistical results) measures to enhance the effectiveness of reducing disclosure risks.

The national office of labour statistics in Singapore has developed a set of strategies based on a blended approach of promotion and preventive measures aimed at reducing risks of statistical data disclosure. This paper outlines the measures implemented and reviews the issues and effectiveness of these strategies in the practical application to different user groups of statistical products, including the general public, policymakers in government departments, and the academic community.