Delete the names from a dataset. Is it anonymous now?
Not necessarily. A record might still contain a rare age, occupation, location and household structure that together identify one person. A business table might reveal a company’s turnover because one company dominates a cell. A map might expose a household even when every point has been rounded.
Statistical disclosure control is the family of methods used to reduce the risk that released statistical data reveal confidential information about identifiable statistical units. The task is not to destroy data until disclosure becomes impossible. It is to manage disclosure risk while preserving enough analytical value for legitimate use.
This is a public educational explanation. It does not describe or expose any private eduKate dataset, access control, internal identifier or security configuration. The general owner for digital protection remains Data Security and Privacy; this page owns the statistical release problem: what can be published, shared or analysed without disclosing confidential respondent information.
Statistical confidentiality is broader than removing personal names
Eurostat defines confidential statistical data as data that allow statistical units to be identified directly or indirectly. Direct identifiers include obvious fields such as names or identification numbers. Indirect identification can arise from combinations of characteristics.
Eurostat’s current statistical confidentiality guidance treats confidentiality as a fundamental principle of European statistics and distinguishes physical and information-security protections from methods that prevent confidential information from being published.
The central lesson applies beyond one legal framework: confidentiality is about what a recipient can infer, not merely which columns have been deleted.
Direct identification and indirect identification
Direct identification is straightforward. A row contains a person’s name, national identifier, exact address or another field that directly points to them.
Indirect identification is more subtle. Suppose a public dataset contains age, occupation, district and household size. No name is present. Yet a 97-year-old specialist in a very small district living in a seven-person household may be unique.
Once the record is linked to external information, an attacker or merely a curious neighbour may infer identity. The disclosure problem therefore depends partly on what other information could reasonably be available.
Identification is not the only disclosure risk
Even when a person is not uniquely identified, a release can disclose sensitive attributes. If every record in a tiny group shares the same condition, business event or income category, learning that someone belongs to the group can reveal information about them.
A strong confidentiality review therefore considers identity disclosure, attribute disclosure and inference from combinations of published outputs.
The goal is not to predict every possible future inference. It is to identify material disclosure pathways under the intended release environment and apply controls proportionate to the risk.
Tabular data can disclose even when no microdata are released
Imagine a table reporting total sales for three businesses in a category. If one business contributes 95% of the total and its approximate sales are already public, the other two businesses’ combined value may be inferred.
Small cells are not the only problem. Dominance can matter. So can subtraction across overlapping tables.
Eurostat’s confidentiality guidance lists tabular protection methods such as suppression, rounding and interval publication. The purpose is to prevent published aggregates from becoming a route back to a confidential unit.
Primary and secondary suppression
Primary suppression hides a cell judged confidential. But if the hidden value can be reconstructed from totals and other visible cells, the protection fails.
Suppose a row total is 100 and visible cells are 20, 30 and 40. Suppressing the fourth cell does nothing: it must equal 10.
Secondary suppression hides additional cells so the confidential value cannot be recovered through simple subtraction. This introduces a utility cost because some nonconfidential values may also need to disappear.
The design problem becomes combinatorial when many linked tables share margins. Protection must be assessed across the release system, not table by table in isolation.
Rounding changes exactness while preserving broad structure
Rounding can reduce the precision available to reconstruct sensitive values. Counts may be rounded to a base or values may be replaced with intervals.
But ordinary deterministic rounding can still leak information across repeated tables. If many differently grouped releases are rounded from the same underlying data, an attacker may combine them to narrow the true values.
Statistical offices therefore use carefully designed rounding or perturbation schemes rather than assuming that removing the last digit is always sufficient.
Recoding reduces detail in high-risk variables
Microdata protection often groups detailed values into broader categories. Exact age can become age bands. Detailed geography can become a larger region. A rare occupation can be grouped into a broader class.
Eurostat’s microdata confidentiality guidance gives examples such as top-coding age, grouping years of immigration and reducing geographic detail in scientific-use files.
Recoding lowers re-identification risk by making records less unique. It also reduces analytical resolution. A researcher studying very old age or fine geographic inequality may lose the variable detail needed for the question.
Top-coding and bottom-coding protect extremes
Extreme values are often identifying. Instead of releasing an exact age of 103, a dataset may record 80+. Instead of an exact very high income, it may release “above threshold”.
This protects rare records but changes the distribution. A researcher cannot calculate an exact mean from a top-coded variable without additional assumptions or special methods.
That limitation should travel with the dataset metadata so users do not silently treat the coded threshold as the actual value.
Local suppression removes selected risky values
Instead of removing an entire record, local suppression removes or masks one or more values in records that are especially identifying.
A record might retain age and occupation but lose a fine geographic code. Another might retain geography but have occupation grouped.
The method can preserve more information than blanket recoding, but it creates missingness that analysts need to understand. Protection decisions become part of the data-generating process.
Sampling can itself be a disclosure-control method
Public-use microdata may contain only a sample of the original statistical records. An adversary who knows that a person belongs to the underlying population cannot automatically know that the person’s record appears in the release.
Sampling reduces certainty of record presence, but it is not a universal solution. Rare combinations may remain identifying, and sample selection can affect statistical utility.
Release sampling also needs to remain distinct from the original survey sampling design. Analysts must know which probabilities belong to population estimation and which belong to confidentiality processing.
Swapping and perturbation change values without simply deleting them
Data swapping exchanges selected attributes across records, often within controlled groups, so published relationships remain broadly plausible while exact record combinations become less reliable for identification.
Other perturbation methods add controlled noise or modify values. Eurostat’s Statistical Disclosure Control overview distinguishes suppression and perturbation families and notes that the appropriate method depends on whether the release is microdata, tables or maps.
Perturbation creates a new statistical object. Users need to know enough about the method to interpret analyses without receiving details that undermine protection.
Microaggregation replaces individuals with small-group summaries
Microaggregation groups similar records and replaces selected values with group-level summaries. The released rows therefore no longer preserve every original individual’s exact values.
The method can reduce uniqueness while retaining some multivariate structure. It also smooths variation and can attenuate relationships.
The key question is not whether a protected dataset “looks realistic.” It is whether the protection level and analytical distortion are acceptable for the intended release.
Maps create a special confidentiality problem
Geographic data can reveal location by design. Fine spatial resolution is valuable for studying neighbourhoods, access and environmental exposure, but the same precision can identify households or businesses.
Eurostat published 2025 guidelines for statistical disclosure control applied to geo-referenced data, reflecting the growing importance of disclosure risk in small-area statistics.
Spatial protection can include aggregation to larger areas, displacement, grid-based release, threshold rules or other perturbation. The utility cost depends on the research question: a method acceptable for national mapping may be unusable for walking-distance analysis.
Rare does not automatically mean identifiable
A rare combination is a warning sign, not proof that a person can be identified. Identification depends on what an intruder knows, the uniqueness of the combination in the population, record inclusion and the release environment.
Likewise, a common combination does not guarantee safety if the released attribute itself is highly sensitive and group membership is externally known.
Risk assessment should therefore use an explicit attacker model and release context rather than a single magical minimum cell size.
K-anonymity is a useful idea with important limits
In a k-anonymous dataset, each released combination of selected quasi-identifiers is shared by at least k records. This encourages analysts to think about uniqueness and equivalence classes.
But k-anonymity alone does not guarantee protection against attribute disclosure, background knowledge or linkage attacks. A group of ten records can all share the same sensitive attribute.
It also says nothing by itself about whether the quasi-identifiers were chosen well or whether the release process is safe across multiple datasets.
Differential privacy answers a different kind of question
Differential privacy provides a formal bound on how much the distribution of released outputs can change when one individual’s record is added or removed, under a specified privacy parameter and mechanism.
This is conceptually different from simply making every record nonunique. It focuses on limiting the incremental information a release provides about any one person.
Differential privacy also has a budget. Repeated queries consume privacy loss under composition rules. Utility depends on the query, data size, mechanism and chosen privacy parameters.
This article does not claim that differential privacy should replace traditional statistical disclosure control everywhere. Statistical agencies choose methods according to legal requirements, data products, user needs and operational constraints.
Safe data are not only about transforming the file
Some useful data are too detailed to release publicly even after substantial transformation. Instead of weakening the data until public release is possible, agencies can control the access environment.
Eurostat’s microdata access framework uses recognised research entities, approved research proposals and controlled access for confidential microdata.
Eurostat CROS describes on-site access, remote access and remote execution, with output checking before results leave secure environments.
This illustrates an important design principle: protect data through a combination of people, projects, environments, files and outputs rather than forcing every use case into a public-download model.
Output checking protects the last mile
A researcher may work safely inside a secure environment and still produce a table that reveals a rare person or dominant business. Output checking reviews analytical results before release.
This can include minimum-cell rules, dominance checks, residual disclosure checks, review of graphs and examination of free-text outputs.
Automated rules help, but unusual analyses may require human judgement. A model coefficient or residual plot can disclose information even when it is not formatted as a conventional table.
Public-use files and scientific-use files serve different readers
Eurostat’s public microdata overview notes that public-use files are prepared so individuals cannot be identified, with an accompanying loss of information value.
Scientific-use files can retain greater detail but are provided under stricter access conditions. Secure-use files can retain still more detail inside controlled environments.
There is therefore no single best version of a dataset. Different manifestations can serve education, exploratory analysis, reproducible research and high-resolution approved research while preserving different levels of confidentiality.
Statistical confidentiality and data protection law overlap but are not identical
Eurostat distinguishes the statistical confidentiality framework from the broader personal-data-protection framework. Statistical confidentiality can apply to business entities as well as natural persons because the obligation concerns statistical units and statistical purpose.
Legal requirements differ by jurisdiction. This article does not provide legal advice. The reusable concept is to identify the applicable confidentiality, privacy and access obligations rather than assume that satisfying one automatically satisfies all others.
Protection can bias analysis
Top-coding compresses extremes. Geography aggregation smooths local variation. Suppression creates missing cells. Noise can alter correlations. Swapping can weaken exact multivariate relationships.
A disclosure-control method is therefore part of the measurement and data-processing history. Analysts should not treat protected data as though they were untouched source records.
Documentation should describe the protection sufficiently for appropriate analysis while avoiding details that would make the protection easier to reverse.
The risk–utility frontier
Imagine two versions of a dataset. Version A preserves exact age, exact neighbourhood and detailed occupation but has unacceptable re-identification risk. Version B groups everything so broadly that no meaningful inequality analysis remains.
The publication problem is to find acceptable points between those extremes, subject to legal and ethical constraints.
There may be several acceptable products rather than one optimum: a public educational file, a scientific-use file and a secure-access file. Each serves a different reader job and carries a different protection boundary.
Linkage risk grows when datasets accumulate
A release judged safe in isolation may become more revealing after another dataset appears. Shared geography, dates, rare categories or sequence patterns can act as linking keys.
This is why disclosure control is a lifecycle problem. Agencies need release registers, version histories and awareness of related products.
The identity mechanics connect to How Record Linkage and Entity Resolution Work. Linkage is useful for research and administration, but the same capability can increase disclosure risk when releases contain identifying combinations.
Synthetic data do not automatically solve confidentiality
Synthetic data replace some or all observed values with draws from a fitted model. This can reduce direct exposure of original records and support code development or exploratory analysis.
But a poorly designed generator can memorise or reproduce rare source records. Highly protected synthetic data can also distort relationships users care about.
The dedicated owner Synthetic Data and Privacy-Preserving Data covers that domain in detail. Here the point is narrower: “synthetic” is not itself a confidentiality guarantee.
A confidentiality review should start with the release, not the raw database
The same confidential source can produce very different releases: a national total, a detailed table, a map, a research microdata file or a fitted-model output.
Each release has its own disclosure surface. Asking “Is the dataset safe?” is therefore less useful than asking “Is this specific release safe in this environment for these recipients under these rules?”
That shift prevents two common failures: overprotecting low-risk aggregates until they become useless, and underprotecting high-resolution products because the underlying database is stored securely.
A practical disclosure-control sequence
- Define the statistical unit and confidentiality obligations.
- Specify the intended release: table, map, microdata, model output or query service.
- Identify direct identifiers and plausible quasi-identifiers.
- Define the recipient and access environment.
- Assess uniqueness, small cells, dominance and linkage risk.
- Consider attribute disclosure and differencing across releases.
- Select protection methods appropriate to the release type.
- Measure analytical utility after protection.
- Document transformations and limitations.
- Test residual disclosure risk across linked outputs.
- Apply output checking for controlled research environments.
- Version the release and record later products that change the linkage environment.
- Reassess when data, external information, methods or law change.
A compact failure register
- Names removed, job done: indirect identifiers remain.
- Only small cells checked: dominant contributors or linkage still disclose.
- One table protected at a time: subtraction across tables reveals suppressed values.
- Protection details hidden completely: researchers cannot interpret distortion.
- Protection details published too precisely: attackers gain a reverse-engineering map.
- Public-release standard applied to all research: useful data are destroyed instead of using controlled access.
- Secure room treated as sufficient: outputs leave without disclosure checking.
- Old release forgotten: a new dataset creates linkage risk with an earlier product.
What a learner should remember
Confidentiality is not the absence of names. It is the inability, within an acceptable risk standard and release environment, to use released statistics to reveal protected information about statistical units.
Every protection method changes information. The craft lies in changing enough to protect people or organisations while preserving enough structure for the legitimate statistical purpose.
That is why strong statistical systems do not choose between privacy and usefulness once. They design different access routes, different data products and different safeguards for different kinds of use.
Sources and further reading
Eurostat guidance and 2025 geo-referenced-data guidance were checked for this edition on 5 September 2026. This article is an explanatory synthesis and not legal advice.
- Eurostat — Statistical confidentiality
- Eurostat CROS — Statistical Disclosure Control
- Eurostat — Statistical confidentiality and personal data protection
- Eurostat — Microdata access
- Eurostat CROS — Microdata access models and output checking
- Eurostat — Guidelines for statistical disclosure control methods applied on geo-referenced data, 2025 edition
Continue through eduKate: use Official Statistics for the institutional context, Data Security and Privacy for general protection, Open Data and Responsible Data Sharing for publication choices, and Synthetic Data and Privacy-Preserving Data for generated alternatives.