Formal Privacy Methods Come to the U.S. Census Bureau's Flagship Products

• Activity Number: 550 - Differential Privacy in Statistical Agencies: Present and Future
• Type: Invited
• Date/Time: Wednesday, August 2, 2017 : 2:00 PM to 3:50 PM
• Sponsor: Government Statistics Section
• Author(s): John M Abowd*
• Companies: U.S. Census Bureau
• Keywords: Formal privacy ; Disclosure limitation ; Differential privacy ; Accuracy-privacy loss tradeoff

Abstract

Formal privacy systems, of which differential privacy is the leading example, provide a principled way to quantify confidentiality protection, prove that a stated limit on privacy loss has been respected by the disclosure limitation method, quantify the accuracy costs associated with the entire disclosure limitation technology, and prove that the released file is protected against all future attacks. For these reasons the U.S. Census Bureau, which was the first statistical agency in the world to use formal privacy methods on a production system (OnTheMap, 2008), has been experimenting with adopting them for its flagship products: the 2020 Census of Population and Housing, the American Community Survey, and the 2017 Economic Census. This is a challenging undertaking. This paper will report progress to-date. In addition, it will report the current state of how the Bureau will decide upon the parameters to be used in these systems when and if they are put in production.