The use of differential privacy for census data and its impact on redistricting: The case of the 2020 U.S. Census.
Ontology highlight
ABSTRACT:
SUBMITTER: Kenny CT
PROVIDER: S-EPMC8494446 | biostudies-literature |
REPOSITORIES: biostudies-literature
Similar Datasets
Project description:Background: The 2020 US Census will use a novel approach to disclosure avoidance to protect respondents' data, called TopDown. This TopDown algorithm was applied to the 2018 end-to-end (E2E) test of the decennial census. The computer code used for this test as well as accompanying exposition has recently been released publicly by the Census Bureau. Methods: We used the available code and data to better understand the error introduced by the E2E disclosure avoidance system when Census Bureau applied it to 1940 census data and we developed an empirical measure of privacy loss to compare the error and privacy of the new approach to that of a (non-differentially private) simple-random-sampling approach to protecting privacy. Results: We found that the empirical privacy loss of TopDown is substantially smaller than the theoretical guarantee for all privacy loss budgets we examined. When run on the 1940 census data, TopDown with a privacy budget of 1.0 was similar in error and privacy loss to that of a simple random sample of 50% of the US population. When run with a privacy budget of 4.0, it was similar in error and privacy loss of a 90% sample. Conclusions: This work fits into the beginning of a discussion on how to best balance privacy and accuracy in decennial census data collection, and there is a need for continued discussion.
| S-EPMC7216402 | biostudies-literature
Project description:The U.S. Census Bureau will implement a modernized privacy-preserving disclosure avoidance system (DAS), which includes application of differential privacy, on publicly released 2020 census data. There are concerns that the DAS may bias small-area and demographically stratified population counts, which play a critical role in public health research, serving as denominators in estimation of disease/mortality rates. Using three DAS demonstration products, we quantify errors attributable to reliance on DAS-protected denominators in standard small-area disease mapping models for characterizing health inequities. We conduct simulation studies and real data analyses of inequities in premature mortality at the census tract level in Massachusetts and Georgia. Results show that overall patterns of inequity by racialized group and economic deprivation level are not compromised by the DAS. While early versions of DAS induce errors in mortality rate estimation that are larger for Black than non-Hispanic white populations in Massachusetts, this issue is ameliorated in newer DAS versions.
| S-EPMC10438951 | biostudies-literature
Project description:Personal data collected by wearable devices contains rich privacy. It is important to realize the personal privacy protection for user data without affecting the data collection of wearable device services. In order to protect users' personal privacy, a collection scheme based on local differential privacy is proposed for the collected single attribute numerical stream data. At first, the stream data points collected by the wearable device are censored to identify the salient points, and the adaptive Laplacian mechanism is used to add noise to these salient points according to the assigned privacy budget; then the collector reconstructs and fits the stream data curve to the noise-added salient points, so as to protect the personal privacy of the data. This scheme is experimented on the heart rate dataset, and the results show that when the privacy budget is 0.5 (i.e., at higher privacy protection strength), the mean relative error is 0.12, which is 57.78% lower than the scheme of Kim et al. With the satisfaction of user privacy protection, the usability of mean value estimation of wearable device stream data is improved.
| S-EPMC9385068 | biostudies-literature
Project description:ObjectiveTo assess the utility of imputing race/ethnicity using U.S. Census race/ethnicity, residential address, and surname information compared to standard missing data methods in a pediatric cohort.Data sources/study settingElectronic health record data from 30 pediatric practices with known race/ethnicity.Study designIn a simulation experiment, we constructed dichotomous and continuous outcomes with pre-specified associations with known race/ethnicity. Bias was introduced by nonrandomly setting race/ethnicity to missing. We compared typical methods for handling missing race/ethnicity (multiple imputation alone with clinical factors, complete case analysis, indicator variables) to multiple imputation incorporating surname and address information.Principal findingsImputation using U.S. Census information reduced bias for both continuous and dichotomous outcomes.ConclusionsThe new method reduces bias when race/ethnicity is partially, nonrandomly missing.
| S-EPMC4545341 | biostudies-literature
Project description:In the V2G network, the release and sharing of real-time data are of great value for data mining. However, publishing these data directly to service providers may reveal the privacy of users. Therefore, it is necessary that the data release model with a privacy protection mechanism protects user privacy in the case of data utility. In this paper, we propose a privacy protection mechanism based on differential privacy to protect the release of data in V2G networks. To improve the utility of the data, we define a variable sliding window, which can dynamically and adaptively adjust the size according to the data. Besides, to allocate the privacy budget reasonably in the variable window, we consider the sampling interval and the proportion of the window. Through experimental analysis on real data sets, and comparison with two representative w event privacy protection methods, we prove that the method in this paper is superior to the existing schemes and improves the utility of the data.
| S-EPMC8080421 | biostudies-literature
Project description:Differential privacy is becoming one gold standard for protecting the privacy of publicly shared data. It has been widely used in social science, data science, public health, information technology, and the U.S. decennial census. Nevertheless, to guarantee differential privacy, existing methods may unavoidably alter the conclusion of original data analysis, as privatization often changes the sample distribution. This phenomenon is known as the trade-off between privacy protection and statistical accuracy. In this work, we mitigate this trade-off by developing a distribution-invariant privatization (DIP) method to reconcile both high statistical accuracy and strict differential privacy. As a result, any downstream statistical or machine learning task yields essentially the same conclusion as if one used the original data. Numerically, under the same strictness of privacy protection, DIP achieves superior statistical accuracy in a wide range of simulation studies and real-world benchmarks.
| S-EPMC10495082 | biostudies-literature
Project description:During the COVID-19 pandemic, the use of mobile phone data for monitoring human mobility patterns has become increasingly common, both to study the impact of travel restrictions on population movement and epidemiological modeling. Despite the importance of these data, the use of location information to guide public policy can raise issues of privacy and ethical use. Studies have shown that simple aggregation does not protect the privacy of an individual, and there are no universal standards for aggregation that guarantee anonymity. Newer methods, such as differential privacy, can provide statistically verifiable protection against identifiability but have been largely untested as inputs for compartment models used in infectious disease epidemiology. Our study examines the application of differential privacy as an anonymisation tool in epidemiological models, studying the impact of adding quantifiable statistical noise to mobile phone-based location data on the bias of ten common epidemiological metrics. We find that many epidemiological metrics are preserved and remain close to their non-private values when the true noise state is less than 20, in a count transition matrix, which corresponds to a privacy-less parameter ϵ = 0.05 per release. We show that differential privacy offers a robust approach to preserving individual privacy in mobility data while providing useful population-level insights for public health. Importantly, we have built a modular software pipeline to facilitate the replication and expansion of our framework.
| S-EPMC10610440 | biostudies-literature
Project description:Does education change people's lives in a way that delays mortality? Or is education primarily a proxy for unobserved endowments that promote longevity? Most scholars conclude that the former is true, but recent evidence based on Danish twin data calls this conclusion into question. Unfortunately, these potentially field-changing findings-that obtaining additional schooling has no independent effect on survival net of other hard-to-observe characteristics-have not yet been subject to replication outside Scandinavia. In this article, we produce the first U.S.-based estimates of the effects of education on mortality using a representative panel of male twin pairs drawn from linked complete-count census and death records. For comparison purposes, and to shed additional light on the roles that neighborhood, family, and genetic factors play in confounding associations between education and mortality, we also produce parallel estimates of the education-mortality relationship using data on (1) unrelated males who lived in different neighborhoods during childhood, (2) unrelated males who shared the same neighborhood growing up, and (3) non-twin siblings who shared the same family environment but whose genetic endowments vary to a greater degree. We find robust associations between education and mortality across all four samples, although estimates are modestly attenuated among twins and non-twin siblings. These findings-coupled with several robustness checks and sensitivity analyses-support a causal interpretation of the association between education and mortality for cohorts of boys born in the United States in the first part of the twentieth century.
| S-EPMC7890646 | biostudies-literature
Project description:BACKGROUND:Patient privacy is a ubiquitous problem around the world. Many existing studies have demonstrated the potential privacy risks associated with sharing of biomedical data. Owing to the increasing need for data sharing and analysis, health care data privacy is drawing more attention. However, to better protect biomedical data privacy, it is essential to assess the privacy risk in the first place. OBJECTIVE:In China, there is no clear regulation for health systems to deidentify data. It is also not known whether a mechanism such as the Health Insurance Portability and Accountability Act (HIPAA) safe harbor policy will achieve sufficient protection. This study aimed to conduct a pilot study using patient data from Chinese hospitals to understand and quantify the privacy risks of Chinese patients. METHODS:We used g-distinct analysis to evaluate the reidentification risks with regard to the HIPAA safe harbor approach when applied to Chinese patients' data. More specifically, we estimated the risks based on the HIPAA safe harbor and limited dataset policies by assuming an attacker has background knowledge of the patient from the public domain. RESULTS:The experiments were conducted on 0.83 million patients (with data field of date of birth, gender, and surrogate ZIP codes generated based on home address) across 33 provincial-level administrative divisions in China. Under the Limited Dataset policy, 19.58% (163,262/833,235) of the population could be uniquely identifiable under the g-distinct metric (ie, 1-distinct). In contrast, the Safe Harbor policy is able to significantly reduce privacy risk, where only 0.072% (601/833,235) of individuals are uniquely identifiable, and the majority of the population is 3000 indistinguishable (ie the population is expected to share common attributes with 3000 or less people). CONCLUSIONS:Through the experiments based on real-world patient data, this work illustrates that the results of g-distinct analysis about Chinese patient privacy risk are similar to those from a previous US study, in which data from different organizations/regions might be vulnerable to different reidentification risks under different policies. This work provides reference to Chinese health care entities for estimating patients' privacy risk during data sharing, which laid the foundation of privacy risk study about Chinese patients' data in the future.
| S-EPMC7055805 | biostudies-literature
Project description:People continue to use technology in new ways, and how governments harness digital information should consider privacy and security concerns. During COVID19, numerous countries deployed digital contact tracing that collect location data from user's smartphones. However, these apps had low adoption rates and faced opposition. We launched an interdisciplinary study to evaluate smartphone location data concerns among college students in the US. Using interviews and a large survey, we find that college students have higher concerns regarding privacy, and place greater trust in local government with their location data. We discuss policy recommendations for implementing improved contact tracing efforts.
| S-EPMC10664924 | biostudies-literature