Guidelines on the protection of tabulated business data

Transcription

1 1(10) Guidelines on the protection of tabulated business data 1 Purpose of the guidelines on the protection of tabulated business data Main rules relating to procedures for the application of the protection guidelines Concepts and methods connected to the statistical disclosure control of tabulated data Recommendations on the protection of tabulated business data Purpose of the guidelines on the protection of tabulated business data The guidelines were prepared to promote responsible ways to operate in statistical disclosure control (SDC) issues. The viewpoint is that of statistical ethics. The procedures relating to SDC and data protection must take into account the responsibility of the national statistical service towards society and enterprises. The service objectives and the SDC actions limiting them must be in balance with each other. These guidelines must be applied when compiling both statistical publications and database tables, as well as ready-made products and special compilations. All those who plan or compile business statistics must familiarise themselves with these guidelines and the underlying acts and principles of statistical ethics. Each department must make a written decision on statistics requiring SDC that describe the activity of enterprises. The decision must be entered in the records. In addition, the departments must make statistics-specific written instructions on the SDC practices to be followed in the framework of the general guidelines and recommendations contained in this document. 2 Main rules relating to procedures for the application of the protection guidelines The director of the department decides which tabulated statistics describe business activity, that is, to which statistics these guidelines are applied. All business statistics requiring SDC must be mentioned in the decision. Business statistics requiring SDC for which SDC practices are discontinued based on an exceptional procedure, such as a publication consent made with the data supplier must also be mentioned. The exceptional procedure must be documented. It is not necessary to detail more precise SDC procedures in the decision entered in the records. A model decision of the statistics to be protected by the department is given in Appendix 1 of this document. A statistical table need not SDC if no disclosure risk is directed to it or the data contained in it are prescribed by law as public. For example, data describing the activity of central and local government authorities and produc-

2 2(10) tion of public services are mainly public 1. Old data of over 25 years concerning enterprises are public, so they can be released unprotected in connection with chargeable assignments. 2 If the statistics require protection against statistical disclosure, instructions must be made on the protection practices to be followed actively within the framework of the recommendations mentioned in these guidelines. The present SDC practices can be continued in those respects that the recommendations do not cause any need for changes. If the present practices are not in written form, they must be written down. The directors of departments are responsible for the implementation of business data protection in their departments. When making tabulated special compilations or chargeable assignments, SDC solutions can be case-specific. Case-specific SDC procedures should be made in writing and they should refer to the assignment agreement in question. For confidentiality reasons, customers must not be given too detailed data on SDC procedures. Active data protection may be supplemented by passive data protection. It is a question of passive data protection when SDC measures are taken at the initiative of the data supplier only. 3 Actively applied SDC measures are always implemented. Supplementing active data protection with passive data protection means in practice that a more lenient sensitivity rule is used in defining the protection need (e.g. the threshold rule), but at the data supplier's request, a stricter sensitivity rule is used alongside a more lenient rule (e.g. the dominance rule). The SDC practices must be relative to the protection need of table data. Too strict protection measures should not be applied to situations where the required data protection target can be reached with more lenient measures. 3 Concepts and methods connected to the statistical disclosure control of tabulated data Business data can generally be presented as magnitude tables, where the cell values are sums, means or other corresponding statistical figures of some response variable (e.g. turnover). Table data are subject to a disclosure risk if there is a risk of disclosure for some statistical unit in the table. Sensitivity rules are used in defining cellspecific disclosure risk. The most common sensitivity rules are: The threshold rule, by which a cell is sensitive if it contains fewer statistical units than the predetermined threshold value. 1 Statistics Act (280/2004), Section 12 2 Act on the Openness of Government Activities (No 621/1999), Section 31 If it is a question of an individual own-account worker (personal data), its term of secrecy is 50 years from the death of that person. 3 This can be compared with the principle of so-called informed consent. Informed consent means that data suppliers (inquiry respondents) are told explicitly for what the statistics will be used (they are informed and are then considered to have been informed) and they can choose whether to respond or not to the inquiry and if they do, they have given their consent to the use of their data in the statistics. Because enterprises are obliged to supply data by virtue of the Statistics Act, not responding is generally not possible and therefore the principle in its pure form is not suitable for statistics describing business activity.

3 3(10) The dominance rule, i.e. the (n,k) rule, according to which a cell is sensitive if its n largest units contribute more than k per cent to the cell total. When using the dominance rule, parameters n and k must be defined numerically to ensure equal treatment of the enterprises the statistics concern. The p% rule 4, by which a cell is sensitive if the estimate for the value of the biggest statistical unit calculated based on the total cell value differs at most by p % from the correct value. More than one sensitivity rule can also be used side by side. In that case, a cell is sensitive if it is sensitive according to at least one sensitivity rule. Either cell suppression or changing the classification is used as the protection method for tables. Cell suppression includes primary suppression of cells with a risk of disclosure and secondary suppression. Secondary suppression ensures that the values of primarily suppressed cells cannot be disclosed by means of table row or column totals. By changing the classification, categories containing cells with a risk of disclosure are combined with other categories in the table. 4 Recommendations on the protection of tabulated business data SDC of tabulated business statistics can be made in different ways depending on various factors connected to the compilation of statistics. Factors influencing SDC are institutional and technical matters related to the collection, nature and use of data. The following presents a four-step hierarchy for business data protection, to which all implementation modes of SDC can be grouped: 1. In situations where exact disclosure is a sensitive matter, the use of the threshold rule is sufficient. The threshold rule is the default rule. The threshold value always has to be at least three. 2. When approximate disclosure is a sensitive matter, the dominance rule or the p% rule must be used as the sensitivity rule. However, using the dominance rule or the p% rule must be restricted to recent statistical data and the threshold value rule must always be used alongside them. Data are recent as long as their disclosure has an impact on the market situation or the activity of an individual enterprise. The time limit for the recentness of data and use of the dominance rule is 15 months from the reference time. The threshold rule must be used for older data than these. In chargeable assignments, the dominance rule must be used alongside the threshold value rule if the risk of endangering confidentiality is stronger due to the customer's identity or limitations made in the information request. 4 The p% rule is not yet used at the departments but Eurostat's expert group on data protection recommends its use (Confidentiality Charter for the treatment of confidentiality at EU level, 2012).

4 4(10) Complementary recommendations 3. If protection can be made by not disseminating the identity and number of data suppliers, this is recommended. Examples of this are estimates calculated from sample data, in connection with which data on the statistical units belonging to the sample are not published. 4. Confidential data can be released if the data supplier gives consent to their publication. Statistics Finland may ask for consent when the use value of the statistics is strongly dependent on the publishing of data on an individual data supplier. Consent to the publication of data can be given only specifically by the enterprise the data concern. 5 The consent must be given in writing and entered in the records. Data protection of an enterprise is endangered partly by that Statistics Finland discloses that the enterprise in question dominates a certain industry or some sample. For this reason, Statistics Finland mainly asks for the publication consent from data suppliers in dominance cases, not the customer. Model consents on data publishing are given as Appendix 2 (Statistics Finland's own publications) and Appendix 3 (chargeable assignments). For Statistics Finland's own publications, consent should be asked from the enterprise as fully as possible so that data on that enterprise could be used for all statistics concerning that enterprise based on the same consent. Time dimension. The time dimension must be taken into account when deciding the SDC procedures of business data. The relevance of business data decreases considerably the more time has passed from the reference time of the statistics to the publication time. Very topical short-term statistics must be protected against approximate disclosure as well. Cell frequencies. Without endangering confidentiality, even small cell frequencies can be published in magnitude tables even if the actual cell value is suppressed. On the other hand, not disseminating the number of statistical units is in applicable circumstances a way by which data on the response variable can be made public. Statistics on establishments. When protecting establishment data, enterprise level protection must also be ensured. When defining the disclosure risk of a cell, attention should be paid to both the number of establishments in the cell and the number of enterprises to which the establishments belong. Sample surveys. Sampling alone is not necessarily a sufficient protection method, because in sample surveys the largest enterprises are usually included and the biggest interest and disclosure risk specifically concerns large enterprises. The disclosure risk of business tables formed from sample data should also be evaluated. The estimates and index point figures enabling disclosure must be protected. An estimate or point figure may enable disclosure if data from only a few enterprises are used in its calculation. Then the reliability of the estimate also suffers. 5 Statistics Act (280/2004), Section 13

5 5(10) To ensure confidentiality and the quality of estimates, a threshold value to the number of enterprises should be used in sample surveys. If a sample is made for a chargeable assignment, the enterprises belonging to the sample must not be disclosed to the customer. Statistics can be produced for a customer on the group of enterprises defined by the customer, which must include at least 30 enterprises. 6 In such assignments, data protection is made according to the above-mentioned recommendations. Cultural and mass media statistics. Some of the compilation publications of cultural and mass media statistics are strongly dependent on data obtained from external sources. Without these data, it would not be reasonable to produce these publications. Therefore, the required data that are elsewhere public can be quoted in the compilation publications of cultural and mass media statistics, provided the source of the data is mentioned. Combining registerbased data and public data obtained from external sources is not allowed in individual tables. User licence. Tabulated business statistics containing detailed data can be released for research use by means of the user licence procedure. Statistics sent to international organisations. Sending of tabulated business statistics to Eurostat or other international organisations must always be based on an act, regulation, decree or other such agreement. The tables are then protected according to the instructions and recommendations defined in the agreement concerned. When separately defined instructions are missing, these guidelines are followed. Statistical examples on following the above-mentioned recommendations are given in Appendix 4. These guidelines will be complied with from the day of decision. The year 2013 will be a transition period for the procedures of these guidelines. Statistics Finland, Director General Marjo Bruun Deputy Director General of Statistics Production Hilkka Vihavainen 6 The number of enterprises can be under 30 in those exceptional cases where it is practical for the assignment and the number of enterprises under 30 does not endanger data protection (see an example in Appendix 4).

6 6(10) Distribution Appendices Intranet Appendix 1: Decision on tabulated business statistics to be protected Appendix 2: Consent to the publication of enterprise data in Statistics Finland's publications Appendix 3: Consent to the publication of enterprise data in connection with chargeable assignment Appendix 4: Statistical examples related to the SDC of tabulated business statistics (CONFIDENTIAL)

7 APPENDIX 1 7(10) Decision on tabulated business statistics to be protected in the Department name Date Our ref. The following business statistics containing tabulated data in the Department name require compliance with active data protection. 1. Statistics 1 2. Statistics 2 3. Statistics-specific guidelines on the SDC practices to be followed are prepared in writing at the department. The following statistics requiring protection are left unprotected based on the mentioned exceptional procedure: 1. Statistics 1: an account of the exceptional procedure, e.g. enterprises with disclosure risk have given their consent to the publication of data (ref. no of the consent) 2. Statistics 2: an account of the exceptional procedure 3. Other than the above-mentioned tabulated business statistics of the Department name do not require protection, because no disclosure risk is directed to them or the data contained in them are prescribed by law as public. Name Director Name Title of the second signatory

8 APPENDIX 2 8(10) Consent to the publication of enterprise data in Statistics Finland's publications Enterprise X Statistics Finland Recipient's department Recipient P.O. Box XX FI Statistics Finland Date Ref. Consent Enterprise X (Business ID) gives its consent to that Statistics Finland can publish statistics from which the turnover, sum of wages and salaries, number of personnel, financial statement and export data of Enterprise X may be inferred. Statistics Finland can also submit the above-mentioned statistical data for international data needs. Statistics Finland receives the data mainly by direct data collection and/or from the Tax Administration's periodic tax return data and/or other source. The consent is valid until further notice. Enterprise X Name and title of the consent giver Signature Appendix: Verification of the signature right Distribution: Registrar s Office

9 APPENDIX 3 9(10) Consent to the publication of enterprise data in connection with chargeable assignment Enterprise X Statistics Finland Department responsible for the assignment Contact person P.O. Box XX FI Statistics Finland Date Ref. Consent Statistics Finland produces various statistics describing business activity as chargeable assignments. In chargeable assignments, not all statistics of a certain area or industry are necessarily used for compilation of statistics. Enterprise X (Business ID) gives its consent to that its data on turnover, sum of wages and salaries, number of personnel, financial statement and exports are used for compiling industry-specific statistics describing the development and state of business activity in X region/sub-regional unit/municipality/other target (ref. of the chargeable assignment). The figures for Enterprise X are not published as separate statistics, but they are part of the industry-specific statistics of the area/target to be described. It may be possible to infer data on an individual enterprise from the statistics. Statistics Finland receives the data mainly by direct data collection and/or from the Tax Administration's periodic tax return data and/or other source. *Where necessary, additional information, e.g. about the reference period of the data to be used*. Enterprise X Name and title of the consent giver Signature

10 APPENDIX 3 10(10) Appendix: Verification of the signature right Distribution: Registrar s Office