Disclosure Limitation Methods Based on Bounds for Large Contingency Tables With Applications to Disability Durham, University of Washington, Seattle, and Carnegie-Mellon University,

Adrian Dobra, Elena A. Erosheva and Stephen E. Fienberg Duke University, Durham, University of Washington, Seattle, and Carnegie-Mellon University, Pittsburgh, USA

CONTENTS 5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 5.2 Example: National Long Term Care Survey Data . . . . . . . . . . . . . . . . . . . . . . . . . 95 5.3 Technical Background on Cell Entry Bounds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 5.4 Decomposable Frontiers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 5.5 “Greedy” Frontiers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 5.6 Bounds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 5.7 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

Much attention has been focused recently on the problem of maintaining the confidentiality of statistical data bases through the application of statistical tools to limit the identification of information on individuals (and enterprises). Here we describe and implement some simple procedures for disclosure limitation based on bounds for the cell entries in contingency tables that result from knowledge about released marginal totals or subtables. Our work draws on the ideas associated with the theory of log-linear models for contingency tables where the minimal sufficient statistics are in fact marginal totals corresponding to the highest-order terms in the model. We draw on recent results associated with decomposable log-linear models and their use in the disclosure limitation context.