Presentation: NCRN Fall 2015: Formal Privacy Protection for Data Products Combining Individual and Employer Frames
No Access Until
Formal Privacy Protection for Data Products Combining Individual and Employer Frames
Published tabular summaries of linked employer-employee data usually use a job frame (statutory employer linked to a specific employee) but include characteristics of both the individual (employee) and workplace (employer establishment). Formal privacy protection of these characteristics requires defining the sensitivity of the published statistic to variation in a single individual or a single workplace (establishment). We propose a model that simultaneously protects individuals and establishments using parameters that control the conventional differential privacy for individuals and a generalization that provides a similar privacy guarantee for the employment magnitudes associated with an employer establishment. We implement our model using three alternative noise distributions. We present results for cross-sectional employment summaries for combinations of employer industry, geography, and ownership; and employee sex, age, race, ethnicity, and education. The system is illustrated using the LEHD Origin-Destination Employment Statistics (LODES) database displayed in the U.S. Census Bureau’s OnTheMap application.
Journal / Series
Volume & Issue
Machanavajjhala acknowledges support from NSF grants 1253327, 1408982, and 1443014. Abowd acknowledges direct support from NSF grants BCS-0941226 and TC-1012593. Abowd and Vilhuber acknowledge support from NSF grant SES-1131848. This paper was written while Abowd was visiting the Center for Labor Economics at UC-Berkeley.
Confidentiality; Differential privacy; LEHD; LODES; Linked Employer-Employee Data
Number of Workers
Based on Related Item
Has Other Format(s)
Part of Related Item
Link(s) to Related Publication(s)
Link(s) to Reference(s)
Previously Published As
Attribution-NonCommercial-NoDerivatives 4.0 International