Abstract

Publishing survey and census data equipped with a privacy guarantee to limit the risk of respondent reidentification is an important goal for government statistical agencies and private companies, worldwide. A commonly-used approach to encode privacy protection into data released to the public generates synthetic data from statistical models estimated on confidential, private data for proposed release by statistical agencies. This data synthesis approach replaces the confidential database with multiple synthetically generated record-level databases. The synthetic databases are released to the public who would use them to conduct any analyses of which they would conceive to be conducted on the real, confidential record-level data. The synthetic data approach replaces multiple queries performed on a summary statistic with the publication of the synthetic databases encoded with privacy protection, making this approach independent of the specific queries performed by users or putative intruders.

We focus on a class of synthetic data generating mechanisms that are formally private. Formally private mechanisms have mathematically provable properties based on a privacy standard. They provide a consistent currency across a variety of data products that allows for privacy accounting against a `budget’ for how much an individual’s data may be used. We introduce a new class of range-restricted formal data privacy standards that condition on owner's beliefs about sensitive data ranges. By incorporating this additional information, we can provide a stronger privacy guarantee (e.g., an amplification). The range-restricted formal privacy standards protect only a subset (or ball) of data values and exclude ranges (or balls) believed to be already publicly known. This provides more targeted protection compared to the standard practice of protecting all data ranges equally, including those that are known to be implausible or impossible.

The privacy standards are designed for the risk-weighted pseudo posterior mechanism (PPM) used to generate synthetic data under an asymptotic differential (aDP) privacy guarantee. The PPM downweights the influence of each record proportionally to its disclosure risk. The PPM is adapted under inclusion of beliefs by adjusting the risk-weighted pseudo likelihood. We express the data owner's knowledge of the sensitive range as a probability that a datum value drawn from the underlying generating distribution lies outside the ball or subspace of values that are sensitive. The portion of each datum likelihood contribution deemed sensitive is then reduced: only a portion of the likelihood is subject to risk down-weighting. We compare privacy and utility properties for the PPM under the aDP and range-restricted privacy standards through a series of simulation studies and a real data application to an accelerated life testing dataset.