Disclosure is the release of data that reveals information or permits deduction of information about a particular survey unit through the release of either tables or microdata. Disclosure avoidance is the process used to protect each survey unit’s identity and data from disclosure. Using disclosure avoidance procedures, the Census Bureau modifies or removes the characteristics that put information at risk of disclosure.

Cell suppression is a disclosure avoidance technique that protects the confidentiality of individual survey units by withholding the values of certain cells within a table from release and replacing the cell value with a symbol, usually a “D”.  If the suppressed cell value were known, it would allow one to estimate an individual survey unit’s data too closely.

The cells that must be protected are called primary suppressions.  To make sure the cell values of the primary suppressions cannot be closely estimated by using other published cell values, additional cells may also be suppressed. These additional suppressed cells are called complementary suppressions.

The process of suppression does not change the higher-level totals. Values for cells that are not suppressed remain unchanged. Before the Census Bureau releases data, computer programs and analysts ensure primary and complementary suppressions have been correctly applied.

Rounding, either from the way data is collected or published, may affect whether a small number is considered a primary suppression.  Ranges are sometimes used in place of D’s to suppress sensitive data, but still provide some meaningful information.

Background on cell suppression, cell sensitivity and the protection of statistical data can be obtained from the Federal Committee on Statistical Methodology's Working Paper 22.

Multiplicative noise infusion is a method of disclosure avoidance in which the quantitative data values for each tabulation unit are perturbed prior to tabulation by applying a random noise multiplier to the magnitude data, such as sales or payroll.  Each record is assigned a single noise factor, which is applied to each quantitative data item as part of the estimation process.  Disclosure protection is accomplished in a manner that causes many published cell values to be perturbed by, at most, a few percentage points.

The CBP Differential Privacy Demonstration Tables use a two-stage disclosure avoidance system:

• In stage one, data are protected with Per-Record Differential Privacy (PRDP).  This stage ensures that every establishment in the CBP database receives a provable privacy guarantee with respect to its existence.  Noise added in the PRDP stage is randomly sampled from a discrete Gaussian distribution, and the total rho-zCDP privacy loss budget is 12.058.
• In stage two, noisy estimates output from the PRDP stage receive additional noise to ensure that establishments in sparse cells have a minimum level of relative protection.

A technical paper with additional detail about the disclosure avoidance system is forthcoming and a live webinar will be held on April 20, 2023 @3pm.  Please see the Events section for more detail.