Optimal Risk-Utility Trade-Off: a Decision Problem With Multiple Objectives

Statistical Disclosure Control (SDC) denotes a set of tools aimed to design and implement data dissemination strategies for statistical data collected under a pledge of confidentiality. The problem is not simple. An ideal data dissemination procedure, in fact, should: (i) allow legitimate data users to perform the statistical analyses of interest as if they were using the data set originally collected; and (ii) reduce the risk of misuses of the data by potential intruders aimed to disclose confidential information about individual respondents. This identifies two conflicting objectives (that we call “maximize safety” and “maximize usefulness”) that no data dissemination procedure can fully achieve simultaneously. Improvement in one of the two objectives usually requires to reduce achievement in the other and there is no data dissemination procedure which is obviously the best. In addition the above objectives are too ambiguous to be of operational use and there is no obvious measure that can be used to quantify the extent to which they are achieved by different candidates for data dissemination. Even assuming that we have defined suitable measures S and V that quantify achievement of the “maximize safety” and “maximize usefulness” objectives, still S and V are usually expressed in different units and have very different meaning so that it is not trivial to compare arbitrary pairs (s, v), and (s′, v′). The problem is even more complex due to the fact that S and V , from the statistical agency perspective, are random variables. In fact the value of S and V depend on the users’ actions that are only partially known to the statistical agency (that for example has uncertainty about users targets, prior information, the estimation procedures that they use, etc). Thus each data dissemination strategy induces a distribution over the space of consequences and choosing among alternative strategies is equivalent to choose among alternative lotteries for (S, V ), a much more difficult task than just express preferences over pairs (s, v). The research literature and current practice in data disclosure limitation, have addressed these issues only in part and to a different extent. Decision theory, we believe, might provide a suitable framework to think about these problems. Within this framework