Can Census Offices publish statistics for more than one small area geography? An analysis of the differencing problem in statistical disclosure

The paper describes a problem faced by National Statistical Offices when publishing the results of decennial censuses for small geographical areas. If they publish statistical tables for two or more sets of areas, users can compare the tables and produce new statistics for the areas formed by differencing, which may have populations below confidentiality thresholds. To investigate the problem, the authors construct a software system and carry out a series of experiments using a large synthetic population base for Yorkshire and Humberside. The results indicate that publishing statistics for zones close in size to the primary areas is not safe unless the zones have been carefully designed. However, publishing statistics for sufficiently large areas such as 5 km grid squares or postal sectors alongside enumeration districts is safe.