General Discrete-Data Modeling Methods for Producing Synthetic Data with Reduced Reidentification Risk That Preserve Analytic Properties

• Activity Number: 71
• Type: Contributed
• Date/Time: Sunday, August 2, 2009 : 4:00 PM to 5:50 PM
• Sponsor: Section on Survey Research Methods
• Author(s): William E. Winkler*+
• Companies: U.S. Census Bureau
• Keywords: privacy ; confidentiality ; synthetic data ; analytic validity

Abstract

This paper describes a modeling framework to produce synthetic microdata that better corresponds to external benchmark constraints on certain aggregates (such as margins) and on which certain cell probabilities are bounded both below and above to reduce re-identification risk. Rather than use linear constraints (Meng and Rubin 1993), the modeling methods use convex constraints (Winkler 1990, 1993) in an extended MCECM procedure. The methods preserve analytic properties and are presented as a computationally tractable alternative to epsilon-privacy (Dwork 2008). Epsilon-privacy and its extensions have not yet been shown to preserve analytic properties (e.g., Dwork, McSherry, and Talwar 2007, section 5). A lone exception is Machanavajjhala et al. (2008) that preserves analytic properties in a narrowly focused "on-the-map" application.