Disclosure Limitation Research Articles

Open government and US development co‐operation in Colombia: Lessons for locally led development

AbstractMotivation“Localization”—direct donor support for national organizations in aid recipient countries—has become a top priority for international development. The United States Agency for International Development (USAID) pledged to raise the proportion of direct funding to national organizations to 25% and for 50% of funding to involve “locally led” input. Independently, USAID commits to proactive disclosure of project information. This study analyses sectoral priorities, access to project data, and localization trends to inform policy discussion about how USAID can reach its twin localization goals, with a focus on Colombia, the largest US aid recipient in Latin America.PurposeAn open government perspective can shed light on whether and how development agencies are making progress towards localization. Moreover, user‐centred information disclosure by donors is necessary to inform locally led development. The goals of this study are to document USAID's sectoral funding priorities, gaps in data disclosure, implementation actions, and direct local funding percentages to make patterns more visible to stakeholders. We ask: What are the strengths and limitations of public disclosure of data concerning US aid in Colombia?Approach and methodsThis analysis uses open‐source data review methods to bring together different sources of publicly available data. These methods include triangulating government data disbursed across multiple sites, recoding government data to make trends visible, and identifying barriers to data access.FindingsPublic data indicate that US funding for peace‐related projects increased in the years following Colombia's 2016 Peace Accord, though the security share of total US aid remains high. Funding trends demonstrate that USAID is far behind its localization goals in Colombia, though absolute funding totals to local organizations are increasing. Finally, publicly available project data are not user‐centred, require technical acumen to access, and are fragmented across multiple sites.Policy implicationsUser‐centred disclosures are key to locally led development to ensure informed participation and accountability to stakeholders.

Capability and accuracy of usual statistical analyses in a real-world setting using a federated approach.

The objective of this project was to determine the capability of a federated analysis approach using DataSHIELD to maintain the level of results of a classical centralized analysis in a real-world setting. This research was carried out on an anonymous synthetic longitudinal real-world oncology cohort randomly splitted in three local databases, mimicking three healthcare organizations, stored in a federated data platform integrating DataSHIELD. No individual data transfer, statistics were calculated simultaneously but in parallel within each healthcare organization and only summary statistics (aggregates) were provided back to the federated data analyst. Descriptive statistics, survival analysis, regression models and correlation were first performed on the centralized approach and then reproduced on the federated approach. The results were then compared between the two approaches. The cohort was splitted in three samples (N1 = 157 patients, N2 = 94 and N3 = 64), 11 derived variables and four types of analyses were generated. All analyses were successfully reproduced using DataSHIELD, except for one descriptive variable due to data disclosure limitation in the federated environment, showing the good capability of DataSHIELD. For descriptive statistics, exactly equivalent results were found for the federated and centralized approaches, except some differences for position measures. Estimates of univariate regression models were similar, with a loss of accuracy observed for multivariate models due to source database variability. Our project showed a practical implementation and use case of a real-world federated approach using DataSHIELD. The capability and accuracy of common data manipulation and analysis were satisfying, and the flexibility of the tool enabled the production of a variety of analyses while preserving the privacy of individual data. The DataSHIELD forum was also a practical source of information and support. In order to find the right balance between privacy and accuracy of the analysis, set-up of privacy requirements should be established prior to the start of the analysis, as well as a data quality review of the participating healthcare organization.

Comment to Muralidhar and Domingo-Ferrer (2023) – Legacy Statistical Disclosure Limitation Techniques Were Not An Option for the 2020 US Census of Population And Housing

Abstract The Article Database Reconstruction is Not So Easy and Is Different from Reidentification, by Krish Muralidhar and Josep Domingo-Ferrer, is an extended attack on the decision of the U.S. Census Bureau to turn its back on legacy statistical disclosure limitation techniques and instead use a bespoke algorithm based on differential privacy to protect the published data products of the Census Bureau’s 2020 Census of Population and Housing (henceforth referred to as the 2020 Census). This response explains why differential privacy was the only realistic choice for protecting sensitive data collected for the 2020 Census. However, differential privacy has a social cost: it requires that practitioners admit that there is inherently a trade-off between the utility of published official statistics and the privacy loss of those whose data are collected under a pledge of confidentiality.

A Rejoinder to Garfinkel (2023) – Legacy Statistical Disclosure Limitation Techniques for Protecting 2020 Decennial US Census: Still a Viable Option

Abstract In our article “Database Reconstruction Is Not So Easy and Is Different from Reidentification”, we show that reconstruction can be averted by properly using traditional statistical disclosure control (SDC) techniques, also sometimes called legacy statistical disclosure limitation (SDL) techniques. Furthermore, we also point out that, even if reconstruction can be performed, it does not imply reidentification. Hence, the risk of reconstruction does not seem to warrant replacing traditional SDC techniques with differential privacy (DP) based protection. In “Legacy Statistical Disclosure Limitation Techniques Were Not an Option for the 2020 US Census of Population and Housing”, by Simson Garfinkel, the author insists that the 2020 Census move to DP was justified. In our view, this latter article contains some misconceptions that we identify and discuss in some detail below. Consequently, we stand by the arguments given in “Database Reconstruction Is Not So Easy:: :”.

ON SOME THEORETICAL AND LEGAL ASPECTS OF DISCLOSURE OF DOCUMENTS IN CIVIL PROCEEDINGS IN ENGLAND AND KAZAKHSTAN

The article deals with the institution of disclosure of documents in civil proceedings in England and its borrowing into domestic civil proceedings. Disclosure of documents is a distinctive feature of civil proceedings in common law countries, its existence in the legal systems of civil law countries is the result of borrowing. From this perspective, the effectiveness of introducing disclosure of documents into civil proceedings in the Republic of Kazakhstan is of interest. The author cites the results of a sociological survey among civil litigators, the results of which demonstrate an incomplete awareness of the essence and meaning of documents disclosure procedures in civil proceedings. The purpose of the research is to determine the essence of documents disclosure, with a demonstration of its effectiveness and potential, by comparing disclosure in English and Kazakhstan law. The author attempts to highlight theoretical aspects of English documents disclosure with a focus on the main objectives and role in civil proceedings. Particular attention is paid to the legal regulation of documents disclosure in England, including objects, subjects, limits of disclosure, as well as liability for non-compliance with disclosure rules. Drawing a parallel between the legal regulation of disclosure in England and the existing legal regulation of disclosure in civil proceedings in Kazakhstan, the author demonstrates the existence of gaps in the rules of the Code of Civil Procedure of the Republic of Kazakhstan, the elimination of which can contribute to the effectiveness of documents disclosure. As a solution of problematic issues it is suggested to introduce amendments into the norms of the Civil Procedure Code of the Republic of Kazakhstan, as well as recommend to issue a normative resolution of the Supreme Court of the Republic of Kazakhstan in order to establish a unified procedure for disclosure of documents.

Balancing Data Provision and Data Protection: A Natural Experiment With HIV and Syphilis Surveillance Data in the United States.

Public release of health data typically requires statistical disclosure limitation (SDL), but scant research demonstrates how real-world SDL affects data usability. Recent changes of federal data re-release policy allow a pseudo-counterfactual comparison of HIV and syphilis data suppression rules. Incident counts (2019) of HIV and syphilis infections by county for Black and White populations were downloaded from the US Centers for Disease Control and Prevention. We quantified and compared suppression status by disease and county between Black and White populations and calculated incident rate ratios for counties with statistically reliable counts. Approximately 50% of US counties have incident HIV counts suppressed for Black and White populations compared with only 5% for syphilis, which has an alternative suppression strategy. The county population sizes protected by a numerator disclosure rule (<4) spans several orders of magnitude. Calculations of incident rate ratios, used as a measure of health disparity, were impossible in the 220 counties most susceptible to an HIV outbreak. Balancing tradeoffs between providing and protecting data are key to health initiatives worldwide. We encourage an increase in empirical research on the impact of SDL, especially in the context of health disparities, and recommend new approaches to avoid the "oppression of data suppression."

Confidentiality Protection in the 2020 US Census of Population and Housing

In an era where external data and computational capabilities far exceed statistical agencies’ own resources and capabilities, they face the renewed challenge of protecting the confidentiality of underlying microdata when publishing statistics in very granular form and ensuring that these granular data are used for statistical purposes only. Conventional statistical disclosure limitation methods are too fragile to address this new challenge. This article discusses the deployment of a differential privacy framework for the 2020 US Census that was customized to protect confidentiality, particularly the most detailed geographic and demographic categories, and deliver controlled accuracy across the full geographic hierarchy.

Balancing data privacy and usability in the federal statistical system

The federal statistical system is experiencing competing pressures for change. On the one hand, for confidentiality reasons, much socially valuable data currently held by federal agencies is either not made available to researchers at all or only made available under onerous conditions. On the other hand, agencies which release public databases face new challenges in protecting the privacy of the subjects in those databases, which leads them to consider releasing fewer data or masking the data in ways that will reduce their accuracy. In this essay, we argue that the discussion has not given proper consideration to the reduced social benefits of data availability and their usability relative to the value of increased levels of privacy protection. A more balanced benefit–cost framework should be used to assess these trade-offs. We express concerns both with synthetic data methods for disclosure limitation, which will reduce the types of research that can be reliably conducted in unknown ways, and with differential privacy criteria that use what we argue is an inappropriate measure of disclosure risk. We recommend that the measure of disclosure risk used to assess all disclosure protection methods focus on what we believe is the risk that individuals should care about, that more study of the impact of differential privacy criteria and synthetic data methods on data usability for research be conducted before either is put into widespread use, and that more research be conducted on alternative methods of disclosure risk reduction that better balance benefits and costs.

Disclosure of risk information in corporate reporting and its integration into the investment decision-making process

Subject. This article explores the trends in disclosure in public reporting and integration into the process of substantiating investment decisions of information about the risks of organizations' activities, their impact on sustainable development at the global and corporate levels. Objectives. The article aims to study risk as an accounting category and object of corporate reporting in the context of improving the accounting financial and non-financial reporting of organizations and determine the impact of systemic integration of risks, including the environmental, social and governance ones, in the process of making investment decisions on interaction with investors and sustainable development of companies. Methods. For the study, I used analysis and synthesis, detailing and generalization, comparison, abstraction, analogy, and systems, strategic, and risk-oriented approaches. Results. The article clarifies the definition of risk and proposes a classification of risks of the organization's activities, taking into account the provisions of the concept of six types of capital and the concept of sustainable development. It provides suggestions for disclosure in an integrated risk report. Based on empirical research, the article defines the recommended limits of disclosure of information on risks by organizations in the framework of ensuring transparency of reporting. It analyzes the factors that encourage economic actors to disclose sustainability risks in corporate reporting and the role of ESG risk information for investors. Conclusions. The integration of ESG risks into the process of generating investment decisions has a positive effect on their quality and contributes to the achievement of the corporation's strategic goals.

Bayesian Inference for Estimating Subset Proportions using Differentially Private Counts

Abstract Recently, several organizations have considered using differentially private algorithms for disclosure limitation when releasing count data. The typical approach is to add random noise to the counts sampled from, for example, a Laplace distribution or symmetric geometric distribution. One advantage of this approach, at least for some differentially private algorithms, is that analysts know the noise distribution and hence have the opportunity to account for it when making inferences about the true counts. In this article, we present Bayesian inference procedures to estimate the posterior distribution of a subset proportion, that is, a ratio of two counts, given the released values. We illustrate the methods under several scenarios, including when the released counts come from surveys or censuses. Using simulations, we show that the Bayesian procedures can result in accurate inferences with close to nominal coverage rates.

Formation, disclosure and presentation of information on equity in conditions of increasing transparency of organizations

The issues of increasing the reliability of information about the organization’s own capital, its presentation and disclosure as part of the financial (accounting) statements in the context of the adoption of new federal accounting standards and changes in the requirements of the regulator are considered. The necessity of increasing the information content of the system of accounting and reporting of equity, including on the basis of international financial reporting standards, is substantiated. The limits of information disclosure due to external and internal factors are analyzed.

Current trends and key limitations of climate-related disclosure by Russian companies

Climate-related disclosure and reporting have become major topics of the discussion among the key players influencing business decisions in the past few years. The United Kingdom and other countries’ plans regarding mandatory climate-related disclosure for the major listed companies, investors’ enquires about CDP questionnaires to be filled and European Union actively promoting its carbon neutral plans influence Russian business community decisions. In order to comply with the latest trends and future demands it is critical to assess corporate carbon footprint correctly, especially for the most carbon intensive companies specialising in mining and steel production, which can be seriously affected by the forecasted EU Carbon Border Tax towards carbon intensive imported products. Although, currently there are some limitations which may misrepresent some of the Russian companies’ greenhouse gas emissions calculation results, and further decarbonisation initiatives. One of the key reasons is a lack of national methodological guidelines and emissions factors provided by the Russian ministries and research centres, which have to guide Russian companies in the field of regional-based emissions assessment. This article examines the current trends of climate-related disclosure based on the CDP scores of Russian companies and discusses the potential ways of improving the national methodological support in order to provide quality and credible data connected with the climate risk management and disclosure. The most important drawbacks were identified, such as the lack of methodological guidelines and emission factors for calculating direct greenhouse gas emissions (Scope 1), regional emissions factors for calculating indirect energy emissions (Scope 2) for the Russian Federation, as well as the lack of both methodological guidelines and emissions factors database for calculating other indirect emissions (Scope 3). Finally, the expected consequences of such methodological disadvantages were described, and the recommended steps to improve the effectiveness of this climate-related disclosure practice were proposed.

Assessing Bayesian Semi‐Parametric Log‐Linear Models: An Application to Disclosure Risk Estimation

SummaryWe propose a method for identifying models with good predictive performance in the family of Bayesian log‐linear mixed models with Dirichlet process random effects for count data. Their wide applicability makes the assessment of model performance crucial in many fields, including disclosure risk estimation, which is the focus of the present work.Rather than assessing models on the whole contingency table, we target the specific objective of the analysis and propose a two‐stage model selection procedure aimed at limiting a form of bias arising in the process of model selection. Our proposal combines two different criteria: at the first stage, a path in the model search space is identified through a strongly penalized log‐likelihood; at the second, a small number of semi‐parametric models is evaluated through a context‐dependent score‐based information criterion. Tested on a variety of contingency tables, our method proves to be able to identify models with good predictive performance in a few steps, even in the presence of large tables with many sampling and structural zeros. We carefully discuss the proposed method in the context of the literature on model assessment and contextualize the illustrative application in the recent debate on statistical disclosure limitation. Finally, we provide examples of further applications in different research areas.

A Full Nesterov-Todd Step Infeasible Interior-point Method for Symmetric Optimization in the Wider Neighborhood of the Central Path.

In this paper, an improved Interior-Point Method (IPM) for solving symmetric optimization problems is presented. Symmetric optimization (SO) problems are linear optimization problems over symmetric cones. In particular, the method can be efficiently applied to an important instance of SO, a Controlled Tabular Adjustment (CTA) problem which is a method used for Statistical Disclosure Limitation (SDL) of tabular data. The presented method is a full Nesterov-Todd step infeasible IPM for SO. The algorithm converges to ε-approximate solution from any starting point whether feasible or infeasible. Each iteration consists of the feasibility step and several centering steps, however, the iterates are obtained in the wider neighborhood of the central path in comparison to the similar algorithms of this type which is the main improvement of the method. However, the currently best known iteration bound known for infeasible short-step methods is still achieved.

Corporate governance and disclosure: purpose, scope, and limitations

Corporate governance has been the subject of dozens, if not hundreds, of books and articles in legal, accounting, finance, and economic literature since at least 1932. Disclosure has also been the subject of dozens, if not hundreds, of books and articles in legal, accounting, finance, and economic literature, but interest in the subject is a more recent phenomenon. It is important therefore to understand the purpose, scope, limitations, and meaning of corporate governance. It is equally important to understand the purpose, scope, and limitations of the effective transparency of information, i.e., disclosure, for publicly listed companies, including what information is disclosed, how it is disclosed, and why it is disclosed. Therefore, this paper examines the purpose, scope, and limitations of corporate governance and disclosure including what, how, and why information about publicly listed companies is disclosed with the intent of providing a better understanding of corporate governance and disclosure and directions for future research.

Total Error and Variability Measures for the Quarterly Workforce Indicators and LEHD Origin-Destination Employment Statistics in Onthemap

Abstract We report results from the first comprehensive total quality evaluation of five major indicators in the U.S. Census Bureau’s Longitudinal Employer-Household Dynamics (LEHD) Program Quarterly Workforce Indicators (QWI): total flow-employment, beginning-of-quarter employment, full-quarter employment, average monthly earnings of full-quarter employees, and total quarterly payroll. Beginning-of-quarter employment is also the main tabulation variable in the LEHD Origin-Destination Employment Statistics (LODES) workplace reports as displayed in OnTheMap (OTM), including OTM for Emergency Management. We account for errors due to coverage; record-level non-response; edit and imputation of item missing data; and statistical disclosure limitation. The analysis reveals that the five publication variables under study are estimated very accurately for tabulations involving at least 10 jobs. Tabulations involving three to nine jobs are a transition zone, where cells may be fit for use with caution. Tabulations involving one or two jobs, which are generally suppressed on fitness-for-use criteria in the QWI and synthesized in LODES, have substantial total variability but can still be used to estimate statistics for untabulated aggregates as long as the job count in the aggregate is more than 10.

Do audit committee attributes influence integrated reporting quality? An agency theory viewpoint

AbstractThe limits of financial disclosure in meeting the investors' needs have led to the request for reporting frameworks capable of incorporating information of different nature. Integrated reporting (IR), which is the latest novelty in organisational reporting practice, promises to bring together material financial and non‐financial information. IR has received considerable academic attention in recent years. However, little attention has been paid to the role of the audit committee in IR processes, despite the influence that this body has on disclosure, thanks to its supervisory and monitoring functions. This study bridges this gap by analysing the effect of the audit committee attributes on integrated reporting quality (IRQ) from an agency theory perspective. The regression analysis, conducted on a sample of 125 international firms, demonstrated a positive effect of size, independence and meeting frequency of the audit committee on IRQ and a non‐significant effect of financial expertise.

An information theoretic approach to post randomization methods under differential privacy

Post randomization methods are among the most popular disclosure limitation techniques for both categorical and continuous data. In the categorical case, given a stochastic matrix M and a specified variable, an individual belonging to category i is changed to category j with probability M_{i,j}. Every approach to choose the randomization matrix M has to balance between two desiderata: (1) preserving as much statistical information from the raw data as possible; (2) guaranteeing the privacy of individuals in the dataset. This trade-off has generally been shown to be very challenging to solve. In this work, we use recent tools from the computer science literature and propose to choose M as the solution of a constrained maximization problems. Specifically, M is chosen as the solution of a constrained maximization problem, where we maximize the mutual information between raw and transformed data, given the constraint that the transformation satisfies the notion of differential privacy. For the general categorical model, it is shown how this maximization problem reduces to a convex linear programming and can be therefore solved with known optimization algorithms.

Comparative Study of Differentially Private Data Synthesis Methods

When sharing data among researchers or releasing data for public use, there is a risk of exposing sensitive information of individuals in the data set. Data synthesis is a statistical disclosure limitation technique for releasing synthetic data sets with pseudo individual records. Traditional data synthesis techniques often rely on strong assumptions of a data intruder’s behaviors and background knowledge to assess disclosure risk. Differential privacy (DP) formulates a theoretical approach for a strong and robust privacy guarantee in data release without having to model intruders’ behaviors. Efforts have been made aiming to incorporate the DP concept in the data synthesis process. In this paper, we examine current DIfferentially Private Data Synthesis (DIPS) techniques for releasing individual-level surrogate data for the original data, compare the techniques conceptually and evaluate the statistical utility and inferential properties of the synthetic data via each DIPS technique through extensive simulation studies. Our work sheds light on the practical feasibility and utility of the various DIPS approaches, and suggests future research directions for DIPS.

Towards formalizing the GDPR’s notion of singling out

There is a significant conceptual gap between legal and mathematical thinking around data privacy. The effect is uncertainty as to which technical offerings meet legal standards. This uncertainty is exacerbated by a litany of successful privacy attacks demonstrating that traditional statistical disclosure limitation techniques often fall short of the privacy envisioned by regulators. We define "predicate singling out," a type of privacy attack intended to capture the concept of singling out appearing in the General Data Protection Regulation (GDPR). An adversary predicate singles out a dataset x using the output of a data-release mechanism [Formula: see text] if it finds a predicate p matching exactly one row in x with probability much better than a statistical baseline. A data-release mechanism that precludes such attacks is "secure against predicate singling out" (PSO secure). We argue that PSO security is a mathematical concept with legal consequences. Any data-release mechanism that purports to "render anonymous" personal data under the GDPR must prevent singling out and, hence, must be PSO secure. We analyze the properties of PSO security, showing that it fails to compose. Namely, a combination of more than logarithmically many exact counts, each individually PSO secure, facilitates predicate singling out. Finally, we ask whether differential privacy and k-anonymity are PSO secure. Leveraging a connection to statistical generalization, we show that differential privacy implies PSO security. However, and in contrast with current legal guidance, k-anonymity does not: There exists a simple predicate singling out attack under mild assumptions on the k-anonymizer and the data distribution.