Chapter 23 — Privacy and data protection: methods I
Lesson map
Lesson 23 published. Map, example, EX067.
flowchart TD
N0["Learning outcomes"]
N1["23.1 Publishing results"]
N2["23.2 Complementary suppression"]
N3["23.3 Information loss"]
N4["23.4 Judgement"]
N5["Lab — Suppressing small cells in a results table"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX067"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["23.1 Publishing results"]
N2["23.2 Complementary suppression"]
N3["23.3 Information loss"]
N4["23.4 Judgement"]
N5["Lab — Suppressing small cells in a results table"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX067"]
[Learning outcomes]
|
v
[23.1 Publishing results]
|
v
[23.2 Complementary suppression]
|
v
[23.3 Information loss]
|
v
[23.4 Judgement]
|
v
[Lab — Suppressing small cells in a results table]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX067]
Learning outcomes
You will (1) apply small-cell suppression to published tables; (2) use complementary suppression; (3) judge when tables are safe.
23.1 Publishing results
Schools publish exam results by group, such as pupils eligible for free school meals. Elena knows from Chapter 19 that small cells can identify children. She applies a common rule: suppress any cell with fewer than five pupils. If a school has three free-meal pupils, publishing their results would reveal much about each. Suppression hides that cell. The rule is simple, but she learns that applying it alone is not enough when totals are also published. Totals let readers subtract. Differencing attacks are a real risk.
23.2 Complementary suppression
If a school's total and the other-group count are published, a reader can subtract to recover the suppressed cell. Elena therefore also suppresses a complementary cell in the same school. The lab applies both rules to eight cells across four schools. Ashby has three free-meal pupils and Moor has two; both are suppressed, with their complements. Four of eight cells are suppressed: two primary and two complementary. Kelso and Penn are published in full because their smallest cells contain twelve and seven pupils.
23.3 Information loss
Suppression hides useful information. Readers of the table cannot compare free-meal outcomes at Ashby and Moor. Elena discusses alternatives: combining small schools into a group, reporting over three years, or publishing rounded figures. NIST SP 800-188 describes such approaches for government statistics. She recommends combining Ashby and Moor for this table, which keeps useful comparisons while protecting individuals, and she shows the trust how the table would look. Combining two small schools loses some detail but keeps trust-wide trends visible. Governors accept the table.
23.4 Judgement
Elena notes that thresholds such as five are conventions, not guarantees. A cell of six pupils may still reveal something if readers know who they are. For sensitive groups, such as pupils with special educational needs, she recommends a higher threshold. She explains that disclosure control combines rules with judgement about who might read the table and what they already know, which connects to the identifiability test in Recital 26. Local readers know many families. Small villages make identification easy. Context decides suppression.
Lab — Suppressing small cells in a results table
# Published exam results by school and group: suppress any cell with fewer than 5 pupils (and its complement).
table = {("Ashby", "free meals"): 3, ("Ashby", "other"): 41, ("Kelso", "free meals"): 12, ("Kelso", "other"): 36,
("Moor", "free meals"): 2, ("Moor", "other"): 18, ("Penn", "free meals"): 7, ("Penn", "other"): 29}
sup = set()
for (s, g), n in table.items():
if n < 5:
sup.add((s, g)); sup.add((s, "other" if g == "free meals" else "free meals"))
for (s, g), n in table.items():
print(f"{s:6s} {g:11s} {'*' if (s, g) in sup else n}")
print(f"suppressed cells: {len(sup)} of {len(table)} (2 primary + 2 complementary)")
Run with python3 lab_cells.py. Verified output:
Ashby free meals *
Ashby other *
Kelso free meals 12
Kelso other 36
Moor free meals *
Moor other *
Penn free meals 7
Penn other 29
suppressed cells: 4 of 8 (2 primary + 2 complementary)
Worked example
Elena suppresses four of eight cells (Ashby and Moor free-meal cells and their complements), discusses information loss and recommends combining small schools and higher thresholds for sensitive groups.
Synthetic case. Tables are synthetic; NIST SP 800-188 and GDPR Recital 26 are real.
Errors and limits
Suppression across several published tables can still be undone by combining them.
Exercises
- EX067 — Complementary reason. Why suppress a complementary cell? Rubric: 3 = otherwise subtraction from totals recovers the suppressed cell;; 2 = mentions totals;; 1 = not needed;; 0 = none.
- EX068 — Suppressed count. How many cells were suppressed and why? Rubric: 3 = four: two primary below five and two complementary;; 2 = number only;; 1 = wrong;; 0 = none.
- EX069 — Higher threshold. When does Elena recommend a higher threshold? Rubric: 3 = for sensitive groups such as special needs pupils;; 2 = mentions sensitivity;; 1 = never;; 0 = none.
Synthesis
Chapter 23 controls disclosure. Chapter 24 designs controls.
Continue studying — chapter 23 of 40
← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →