An Evaluation of Anonymization Methods for Creating Detailed Geographical Data

Abstract

In the field of official statistics, National Statistical Organizations in various countries are increasingly focusing on 'differential privacy' (an approach originally developed in computer science) as a method to prevent the disclosure of identifiable information by adding noise to the data. A motivating factor for this interest is the risk of `differencing attack' by which individuals can be potentially identified via a combination of several statistical tables taken from the outputs of small area statistics. This paper first introduces an empirical study that the U.S. Census Bureau conducted on differential privacy based on the 2010 Population Census data in the United States. This paper also examines the security and usability of statistical tables for which Laplace noise was introduced based on the methodology of differential privacy. Data used for this are grid squared statistics from the 2010 Japanese Population Census. Results show that the methodology of differential privacy is potentially applicable for Japanese Population Census data including small area statistics.