An Improved Formulation of the Disclosure Auditing Problem for Secondary Cell Suppression

Statistical agencies have to ensure that respondents' private information cannot be revealed from the tables they release. A well-known protection method is cell suppression, where values that provide too much information are left out from the table to be published. In a first step, sensitive cell values are suppressed. This is called primary suppression. In a second step, other values are suppressed as well to exclude that primarily suppressed values can be re-calculated from the values published in the table. This second step is called secondary cell suppression. In this article we explain that the problem of checking whether a pattern of secondary cell suppressions is safe for release or not is generally described in a slightly inconsistent way in the literature. We illustrate with examples that the criteria that are often applied to judge whether a table can be safely published or not do not always give satisfactory results. Furthermore, we present a new criterion and explore some of its consequences. The new criterion is an extension of the well-known (p,q)-prior-posterior rule. This extension is for aggregations of suppressed cells for which a value can be derived from the table. Finally, we provide a method to apply the new criterion in practice.