With the 2020 Census now underway, there is substantial national and global interest in the U.S. Census Bureau’s decision to modernize the statistical safeguards that will be used to protect respondent privacy. The Census Bureau’s adoption of differential privacy for the 2020 Census marks a transformational moment for official statistics. But, the transition to differential privacy has raised a number of questions about the proper balance between privacy and accuracy in official statistics, the prioritization of certain data uses over others, and the future of statistical offices and their data products. As organizations increasingly consider differential privacy as a solution to the vexing privacy threats of today, the Census Bureau’s experiences in navigating these issues may be instructive for statistical agencies, corporations, researchers, and data users across the United States, and around the world.
Keywords: census, differential privacy, disclosure avoidance, statistical infrastructure, official statistics, data privacy
April 1, 2020, is Census Day in the United States. Mandated by Article I, Section 2 of the U.S. Constitution, this once-every-decade data collection is the nation’s largest civilian mobilization effort. The 2020 Census1 is projected to cost approximately $15.6 billion from start to finish. While the majority of households across the nation are expected to self-respond (by internet, telephone, or mail), the U.S. Census Bureau is expected to hire up to 500,000 temporary census takers to also go door-to-door to those households that do not respond, in an effort to count every person in every household “once, only once, and in the right place.” Field operations are critical to the success of this operation, both to process the millions of paper questionnaires at the Census Bureau’s processing centers, and to visit those households that do not self-respond. However, “In light of the COVID-19 outbreak, the U.S. Census Bureau has adjusted 2020 Census operations” in order to “protect the health and safety of Census employees and the American public” and to “ensure a complete and accurate count of all communities” (U.S. Census Bureau, 2020b). To that end, “The 2020 Census is adaptable and equipped with an approximate $2 billion dollar contingency budget for circumstances like the COVID-19 outbreak” (U.S. Department of Commerce, 2020).
The expense and logistics involved in this recurring enumeration of the nation’s population may seem daunting, but the data collected are critical to decision-making at all levels of society. Census data are used to apportion seats in the U.S. House of Representatives, help guide the allocation of approximately $675 billion in federal funds each year based on population counts, geography, and demographic characteristics (Hotchkiss & Phelan, 2017), support critical public and private sector decision-making at the national, state, and local levels, and serve as the benchmark statistics for innumerable surveys and analyses throughout the subsequent decade (Sullivan, 2020). Throughout its history, the Census Bureau has taken this responsibility seriously, and with each census, the Census Bureau improves and adapts its methods in an effort to produce the most complete and accurate count possible.
Producing accurate data to support these important functions is central to the Census Bureau’s mission “to serve as the nation's leading provider of quality data about its people and economy.” But, in fulfilling this responsibility, the Census Bureau is also required to ensure the privacy of its respondents and the confidentiality of their data. Title 13, Section 9 of the U.S. Code2 prohibits the agency from disclosing any personally identifiable information in its statistics and data products. To balance these countervailing responsibilities, the Census Bureau has long been a world leader in the design and innovation of statistical methods that minimize the likelihood that individuals can be reidentified in its public data products. As statistical offices and other data-centric organizations around the world will know, however, recent advances in computing power and the proliferation of third-party data sources make this task increasingly difficult. Recent internal experiments at the Census Bureau sought to assess this growing vulnerability, and the results were alarming. Using only a portion of the publicly released aggregate data from the 2010 Census,3 Census Bureau researchers were able to accurately reconstruct individual-level records with selected attributes for the entire U.S. population, and were able to accurately determine location (census block), age (+/- one year), sex, race (63 categories), and ethnicity for 219 million individuals. At that degree of precision, more than 50% of all persons censused in 2010 were unique within the population. Matching these individual records against commercially available data from 2010 to attach names to these records, the Census Bureau was able to confirm accurate reidentifications for 52 million people (Abowd, 2019). Recognizing that the traditional statistical techniques used to protect privacy in prior decades are increasingly insufficient to counter the privacy threats of today, the Census Bureau decided to modernize its approach to data protection and has committed to using differential privacy to protect the confidentiality of the 2020 Census (U.S. Census Bureau, 2019).
This journal has previously examined the basics of differential privacy, including an excellent discussion by Daniel L. Oberski and Frauke Kreuter in volume 2.1 (2020), so I would direct readers interested in learning more about differential privacy as an approach to those articles. Instead, I would like to highlight some of the lessons that the Census Bureau has learned so far from its implementation of differential privacy. Statistical offices, corporations, researchers, and data users across the United States and around the world are watching the Census Bureau’s adoption of differential privacy with keen interest, and I hope that our experiences (and missteps) along the way will prove instructive.4
The database reconstruction theorem, also known as the fundamental law of information reconstruction, tells us that if you publish too many statistics derived from a confidential data source, at too high a degree of accuracy, then after a finite number of queries you will completely expose the confidential data (Dinur & Nissim, 2003). All statistical disclosure limitation techniques, including traditional and formally private methods, seek to protect privacy by limiting the quantity of data released (e.g., through suppression) or by reducing the accuracy of the data. It should be noted that the impacts of any privacy protection method on data availability or accuracy should not be seen as technical byproducts; protecting respondent privacy fundamentally requires reducing one or both of these dimensions to be effective. Protection methodologies that rely on suppression or coarsening of the data can have significant impacts on data usability, but these methods have generally been tolerated by data users because the reasons for their use are fairly intuitive; the link between small cell counts or highly precise statistics and the identities of specific individuals is easy to grasp. Methodologies that rely on noise injection to protect privacy also have not received much criticism by data users largely because these methods’ impact on data accuracy are not typically observable; in most implementations the swapping rates or noise injection parameters and assessments about their impact on accuracy are kept confidential to prevent reverse engineering of the original, confidential data.
The transparency of formally private methods, and the explicit quantification of the privacy vs. accuracy trade-off through the use of privacy-loss budgets (epsilon), have enabled data users and privacy advocates to openly observe and debate the relative importance of accuracy vs. privacy in unprecedented ways. Where policy decisions about what constituted “sufficient” protection or accuracy were previously made behind closed doors, differential privacy has brought that debate into the court of public opinion. Over the last few months, the Census Bureau has learned the hard way that navigating this debate is difficult, but essential, to maintaining both the public’s trust in the proper safeguarding of their information, and the credibility of the data products on which data users rely.
When implementing differential privacy, the privacy-loss budget makes data accuracy and privacy competing uses of a finite resource: the information (bits) in the underlying data (Abowd & Schmutte, 2019). It is impossible to protect privacy while also releasing highly accurate data to support every conceivable use case, and vice versa. While statistics for large populations—for example, for entire states or for major metropolitan areas—can be adequately protected with negligible amounts of noise, many important uses of census data require calculations on smaller populations, where the impacts of noise can be much more significant. When designing the differentially private systems that will be used for the 2020 Census, the Census Bureau had to start by enumerating the myriad ways that census data are used and identifying which of those uses are more critical than others.5 Some priority use cases are obvious: those that support congressional and state legislative redistricting, for example, or those that enable the equitable and efficient allocation of federal or state funding. But, deciding the relative priority of other important uses of census data is more difficult. For example, should more of the privacy-loss budget be expended on statistics that allow municipalities to know where to build hospitals and schools, or should it be spent on benchmark statistics that serve as the sampling frame and survey weights for demographic and health care surveys throughout the decade?
The relative prioritization of these use cases among many others, and the implications that they have on the design and implementation of a differentially private system cannot be made without extensive engagement and discussion with the various data user communities. In making these decisions, the Census Bureau has had to rely on the expert advice of its federal advisory committees, formal consultations with American Indian and Alaska Native tribal leaders, ongoing engagement with state and local governments, data user groups, and professional associations, as well as feedback from the public at large. While statistical offices and their data users may find this type of engagement challenging—pitting the relative importance of accuracy for one group of data users over another—it is worth considering that having these debates represents an improvement over the status quo ante. Most uses of traditional disclosure avoidance methods, like data swapping, required making similar trade-offs, but the confidential nature of those methods’ design, parameters, and impacts on accuracy (considered necessary to prevent reverse engineering of the confidential data) meant that these were internal agency decisions. The increased transparency that differential privacy permits now allows these trade-offs, and their consequences, to be publicly discussed and debated.
How you implement any disclosure avoidance strategy will impact the accuracy and usability of the resulting data, and this is especially true for differentially private methods. In fact, the design of the system can often have more of an impact on the accuracy of the resulting data than the selection of the privacy-loss budget. With differential privacy, the amount of noise you must inject into the data is dependent on the sensitivity of the calculation you are performing. Because that sensitivity depends on the impact that the presence or absence of any individual could have on the resulting calculation, some statistics (e.g., simple counts of individuals) typically require less noise than others (e.g., mean age). But even if you are limiting your calculations to simple counting queries, the way you combine possible values of the attributes you are counting can quickly increase the sensitivity of the calculation dramatically. Take statistics about racial demographics, for example. The decennial census produces a number of tables that disaggregate population statistics by 63 values for race, that is, the six racial categories, including some other race, alone, or in any combination except “none of the above.” But the census also allows individuals to write in detailed racial groups within those categories (e.g., “Scottish” or “Cherokee”), and produces other data products that disaggregate by all the permutations of those detailed groups. Because the range of possible values for these two different sets of tabulations differ dramatically when measured alone or in combination, so does the sensitivity of those calculations.
Put another way, the mathematical framework of differential privacy shows us something that was often obscured when using traditional disclosure avoidance methods: protecting privacy is significantly more costly for some queries than for others. Adopting a one-size-fits-all approach to algorithm design for these different sets of tabulations would quickly exhaust the overall privacy-loss budget, resulting in poor accuracy across the board. Instead, to address the added sensitivity of the detailed race groupings, the Census Bureau chose to implement two different disclosure avoidance solutions for these groups of data products, each based on differential privacy and sharing the same global privacy-loss budget, but with separate algorithms designed to optimize for accuracy in different ways. Understanding the varying sensitivity of your desired statistics, and more importantly, knowing which data use cases are most important, are critical to designing the system or systems that will best meet the needs of your data users.
Sometimes the algorithms you design to implement differential privacy behave in unexpected ways. The Census Bureau learned this lesson the hard way in October 2019 when it produced a set of demonstration data products that ran 2010 Census data through an early version of the Disclosure Avoidance System (DAS). In that instance, the postprocessing that the algorithm performed on the data to render it into the format traditionally associated with census results (nonnegative integers with tabular consistency) introduced far more error into the resulting data than came from the differentially private noise used to protect privacy. Even more concerning was the fact that while the differentially private noise was statistically unbiased, the postprocessing errors introduced some significant biases into the data, effectively moving people from urban centers to rural areas, among other distortions. This experience illustrates the importance of not relying on intuitive solutions without fully understanding their theoretical properties or implications; it is critical that you test and retest how that system operates in practice. Ideally, get your data users involved in the process, so that they can help you identify where and how your algorithm may not be behaving as intended. Based on the feedback received from various data user groups about the demonstration data (Committee on National Statistics, 2019), the Census Bureau is already implementing a number of design changes to the DAS to mitigate those unanticipated distortions. These efforts will continue throughout the remainder of 2020, and the Census Bureau is working closely with the data user community throughout this process (Abowd & Velkoff, 2020).
Consumers of official statistics, particularly those who use data products that have been produced for a long time, are accustomed to the data looking a certain way, and to interpreting those data as the ‘ground truth.’ As such, they are unaccustomed to seeing population counts with fractional or negative values. Because differential privacy injects noise from a symmetric distribution (typically Laplace or geometric), the raw noisy statistics emerging from the privacy protection stage of a formally private algorithm will usually include fractional and negative values, and different tabulations of the same characteristic may not be internally consistent (e.g., the total number of people in a geography may not equal the sum of males and females within that geography). The process of converting these noisy values into nonnegative integers with tabular consistency therefore introduces more error into the data than is strictly necessary to protect privacy, although it can also improve the error in some dimensions (e.g., by constraining the cumulative noise at lower geographic levels using the counts determined for larger geographies). As the use of differential privacy for official statistics expands, it would be advantageous for statistical agencies and data users alike to reevaluate their adherence to traditional expectations for how official statistics should look. It may be confusing to say that a town has a negative, fractional number of individuals with a particular combination of uncommon attributes, but relaxing the assumptions of nonnegativity and integrality can provide consumers of official statistics with more accurate data on a cumulative scale. Adopting these changes would require explanation and guidance on how to properly interpret these statistics, but would enable data users to effectively model the unbiased noise from the privacy protections into their analyses, improving the overall accuracy of their results. For example, by knowing the sensitivity of the query that produced a differentially private statistic, and the share of the privacy-loss budget allocated to that query, data users can calculate the probability distribution of the noise used to protect the statistic. Then, using likelihood or Bayesian methods, they can factor those conditional probabilities into their analyses, yielding better statistical results (Abowd & Schmutte, 2016, Technical Appendix).
One of the largest vulnerabilities for the census--and for official statistics more broadly--is that the data are used for so many diverse purposes that supporting those uses has traditionally required publishing data at very fine levels of granularity. It is worth considering that many of these uses could be supported through alternative statistical products without the public release of the finely disaggregated data. Alternative data products could permit statistical agencies to produce more accurate inputs to these uses at a lower overall privacy risk. Tiered access models, for example, where approved data users could access the confidential data for their analysis, with noise injected to their results, have long been seen as a viable alternative for some uses. With the passage of the Foundations for Evidence-Based Policymaking Act of 2018, the federal government is exploring how to increase the availability of confidential data through tiered access methods (Potok, 2019). Synthetic data sets with validation servers, and formally private public-facing analysis engines that run calculations on the confidential data and return noisy results could also reduce public demand for the more privacy-challenging granular data products on which data users have traditionally relied.
Another promising trend to address this issue is the blending of official tabulated statistics with official estimates based on statistical models. In many cases the other sources of uncertainty present in low-level data (operational error, coverage error, measurement error, etc.) are significant enough that data quality is already low. Statistical agencies, including the Census Bureau, release data at very detailed levels of geography to support the use case of building aggregates not elsewhere defined. It is well-known that these detailed geographical units should not be considered error-free estimates of the small area. The use of statistical models that can account for these sources of error, and that can incorporate formally private noise into the models, may yield more useful small-area data for data users than they currently get. Though it has not yet transitioned to differential privacy, the Census Bureau’s Small Area Income and Poverty Estimates program, which models data from the American Community Survey, is a good example of the value of small area modeling for official statistics. As statistical offices evaluate the usefulness of their existing data products, or especially as they consider the release of new data products, it would be advantageous to think about how they can leverage these new approaches and technologies to provide more useful data for their data users, without incurring the privacy risks associated with the public release of finely disaggregated data.
When engaging in discussions about the growing privacy risks, it is easy to think that the solution is to just decrease how much data you release, or to increase the privacy protections. Differential privacy certainly provides a mechanism to do this: just set your privacy-loss budget lower to compensate for the added risk. Statistical officials should, however, be wary of increasing the protections as a long-term solution. Yes, the Census Bureau, like statistical offices around the world, has a legal and ethical obligation to protect confidentiality, but the fundamental reason for operating is the production of statistical data products that support our respective societies. If the data products agencies produce lose their utility because they have lowered accuracy too much in the service of those confidentiality protections, then they should ask themselves why they are producing statistics in the first place. To remain viable and valuable to our societies, statistical agencies and the policymakers who direct them need to consider responses to these growing privacy threats as part of a broader discussion about what official statistics are, what form they should take, what legal privacy protections they should have, and how statistical agencies can support data users in new and innovative ways.
The Census Bureau will release the first of the differentially private data products from the 2020 Census in March 2021. Between now and then, there are a number of important tasks remaining to accomplish. The algorithms that will apply differential privacy on these data are already in place, but much can still be done to improve their operation and to optimize the systems to improve accuracy for the priority data use cases. Similarly, the Census Bureau must still make the final policy decisions regarding the global privacy-loss budget for the 2020 Census, as well as the final allocation of that privacy-loss budget across the various data products, tables, geographic levels, and queries. The Census Bureau will provide regular updates on these efforts via the Census Bureau's Disclosure Avoidance Modernization webpage. Continued input from the data science community will be invaluable to these design improvements and policy discussions. Readers with suggestions, recommendations, and technical or policy considerations relating to any of the topics discussed here can submit them to the Census Bureau at [email protected]. The implementation of differential privacy for the 2020 Census marks a transformational moment for official statistics and for the broader data science community. Your engagement and input can help ensure that this effort will be a success.
The author drafted this article as part of his official duties as an employee of the U.S. Census Bureau. This article benefited substantially from the helpful comments and suggestions of John Abowd, Victoria Velkoff, Cynthia Hollingsworth, Nancy Potok, Frauke Kreuter, Xiao-Li Meng, Shelly Martinez, danah boyd, and an anonymous reviewer. The author would also like to thank his many colleagues at the Census Bureau who contributed to the information contained herein.
The views stated in this article are those of the author and not the U.S. Census Bureau. The statistics in this article have been cleared for public dissemination by the Census Bureau Disclosure Review Board (CBDRB-FY20-100).
Abowd, J. M. (2018). The U.S. Census Bureau adopts differential privacy. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining (p. 2867). https://doi.org/10.1145/3219819.3226070
Abowd, J. M. (2019, February 16). Staring-down the database reconstruction theorem [Conference session]. American Association for the Advancement of Science Annual Meeting, Washington, DC. Retrieved from https://www2.census.gov/programs-surveys/decennial/2020/resources/presentations-publications/2019-02-16-abowd-db-reconstruction.pdf?
Abowd, J. M., & Schmutte, I. M. (2016). Economic analysis and statistical disclosure limitation. Brookings Papers on Economic Activity, 2015(1), 221–293. https://doi.org/10.1353/eca.2016.0004
Abowd, J. M., & Schmutte, I. M. (2019). An economic analysis of privacy protection and statistical accuracy as social choices. American Economic Review, 109(1), 171–202. https://doi.org/10.1257/aer.20170627
Abowd, J., & Velkoff, V. (2020, February 12). Census Bureau works with data users to protect 2020 Census data products. Research Matters Blog, U.S. Census Bureau. https://www.census.gov/newsroom/blogs/research-matters/2020/02/census_bureau_works.html
Committee on National Statistics, National Academies of Science, Engineering, and Medicine. (2019). Workshop on 2020 Census data products: Data needs and privacy considerations. https://sites.nationalacademies.org/DBASSE/CNSTAT/DBASSE_196518?
Dinur, I., & Nissim, K. (2003). Revealing information while preserving privacy. In Proceedings of the Twenty-Second ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems (pp. 202–210). https://doi.org/10.1145/773153.773173
Garfinkel, S. L., Abowd, J. M., & Powazek, S. (2018). Issues encountered deploying differential privacy. In Proceedings of the 2018 Workshop on Privacy in the Electronic Society (133–137). https://doi.org/10.1145/3267323.3268949
Hotchkiss, M., & Phelan, J. (2017). Uses of Census Bureau data in federal funds distribution: A new design for the 21st century. United States Census Bureau. https://www2.census.gov/programs-surveys/decennial/2020/program-management/working-papers/Uses-of-Census-Bureau-Data-in-Federal-Funds-Distribution.pdf
Oberski, D. L., & Kreuter, F. (2020). Differential privacy and social science: An urgent puzzle. Harvard Data Science Review, 2(1). https://doi.org/10.1162/99608f92.63a22079
Potok, N. (2019). Deep policy learning: Opportunities and challenges from the Evidence Act. Harvard Data Science Review, 1(2). https://doi.org/10.1162/99608f92.77e63f8f
Sullivan, T. A. (2020). Coming to our census: How social statistics underpin our democracy (and republic). Harvard Data Science Review, 2(1). https://doi.org/10.1162/99608f92.c871f9e0
U.S. Census Bureau (2019). 2020 census memorandum 2019.12: Disclosure avoidance system design requirement—State resident population and the Federally Affiliated Count Overseas (FACO). https://www.census.gov/programs-surveys/decennial-census/2020-census/planning-management/memo-series/2020-memo-2019_12.html
U.S. Census Bureau. (2020a). Data metrics for 2020 disclosure avoidance. https://www2.census.gov/programs-surveys/decennial/2020/program-management/data-product-planning/disclosure-avoidance-system/2020-03-25-data-metrics-2020-da.pdf?#
U.S. Census Bureau. (2020b). 2020 census operational adjustments due to COVID-19. https://2020census.gov/en/news-events/operational-adjustments-covid-19.html
U.S. Department of Commerce. (2020). Statement from secretary of commerce Wilbur Ross on the 2020 census and COVID-19. https://www.commerce.gov/news/press-releases/2020/03/statement-secretary-commerce-wilbur-ross-2020-census-and-covid-19
©2020 Michael B. Hawes. This article is licensed under a Creative Commons Attribution (CC BY 4.0) International license, except where otherwise indicated with respect to particular material included in the article.