What is unintentional disclosure?

Unintentional disclosure of personally identifiable information is one of the greater challenges to publishing open data.  Even when you are mindful of and have suppressed personally identifiable information, and other confidential data, your data may contain easily observable and/or unique characteristics where alone or in combination can increase the risk of unintentional disclosure by producing a small group of individuals for which they apply.[1]  Some examples include:

  • Very high income
  • Very low income
  • Unusual occupation
  • Unusual health condition
  • Very high age
  • Unusual racial category
  • Small geographic area
  • Small time period

Many statisticians consider a group of 3 to be the minimum needed to prevent disclosure, though larger minimums (e.g., 5 or 10) may be used to further mitigate disclosure risk if deemed appropriate for the nature of the data.  However, a small group by itself does not necessarily constitute disclosure.  When considering disclosure risk, you should consider whether a “reasonable person” (i.e., a hypothetical, rational, prudent, average individual) with no personal knowledge of relevant circumstances could identify the individual based on publicized events or highly unique characteristics associated with the individual.[2]

Unintentional disclosure could also occur where a large percentage of individuals fall within a category and makes it fairly certain who the data applies to.  For example, if a dataset shows all 11th grade males at a specific school as “Below Proficient” on a given assessment, there is no question who the information applies to.

Agencies should consider implementing safeguards to help prevent the unintentional disclosure of confidential and sensitive data.

[1] Checklist on Disclosure Potential of Proposed Data Releases, Federal Committee on Statistical Methodology, July 1999, http://fcsm.sites.usa.gov/files/2014/04/checklist_799.doc

[2] Frequently Asked Questions—Disclosure Avoidance, Privacy Technical Assistance Center, May 2013, http://ptac.ed.gov/sites/default/files/FAQs_disclosure_avoidance.pdf

Program Area
Open Data, Privacy, Confidentiality, Unintentional Disclosure

Printed from the Iowa Department of Management website on April 26, 2018 at 7:48pm.