An In-Depth Examination of Requirements for Disclosure Risk Assessment

enumerate• Please note that statements such as “data not shown” and “personal communication” cannot be used to support claims in the work and should be removed prior to submission The supplemental information has been edited to remove the citation to a “personal communication.” The text of the email is still in SI Section 7 because all parties provided PNAS permission to quote the email thread. I have asked the managing editor to confirm that this is in compliance. • Reviewer two raises one issue that is due to a misunderstanding that should be easy for your group to correct. The misunderstanding was about the “arbitrarily many [kinds of] analyses.” We reverted the changes and removed “kinds of” as the reviewer requested. • This reviewer also wants you to define “coarsening” in the text, and spell out the wording that leads to the acronym PUMS. I would urge you to apply the same logic to all such phrases used in the text. The paper is a hard read for many of us as is, and your goal is to enlighten us. After the first mention of coarsening, we added “(See SI-2 for a comparative discussion)" at lines 28-29. The review indicated that reference to the SI was acceptable here. For PUMS, which is used in a direct quotation, and we added clarifications as follows in lines 156-159: “in past censuses, it was possible to create a PUMS-like [Public-Use Microdata Sample] file from the SF1 tables [i.e., decennial census publications]. It was just a pain in the neck.” \itemThis reviewer also makes two other points. One is about “future proof.” In itself this is an impossible criteria, but mentioning that the procedure should take into account the availability of data that is likely to become available should be noted somewhere. We added the following in Section 2K at lines 450-451 to discuss future-proofness: “What if the assumptions are wrong or obsolescent (e.g., when new external datasets become available in the future)?” • Finally this reviewer has comments with respect to citations that should also be addressed We added the relevant citations to Dwork 2006 and Dwork et al. 2006 at line 49 and in the references. We cited the “Fienberg problem” and added a brief discussion at lines 279-281. In general, we we tried to cite the strongest or most in-depth examination of a specific point (due to PNAS limitations on total citations). For example, the counterfactual methodology of differential privacy is considered in depth in a much later paper, however, we did add the original differential privacy paper citations, since the referee is correct in treating them as seminal. \itemI do not understand the logic behind the “Fienberg problem". If you do, explaining it in a footnote would enable the researcher to be cognizant about when it might arise. I think it is clear to the community that not everything can be covered by DP. My worry here would be mostly about firm level data, as some of this data could be used in antitrust cases if it was identified. We addressed this request by adding the following sentence to desideratum 2D at lines 279-281 (support arbitrary statistical analyses): \emph{Note, however that quantifying privacy loss due to exploratory analysis of raw data, known as the “Fienberg Problem” (25), is an open research question.}

enumerate\itemThere is one point of confusion that must be cleaned up. In Section 4E (Support arbitrarily many kinds of analyses), the words "kinds of" were added in response to my previous review, but I now see that I misunderstood the first time around. ... it seems the original wording of "arbitrary many analyses" was in fact the right point: arbitrary degree/amount of composition. The issue does not seem to be variety, but instead is multiplicity. Change the wording back and clarify. With the potential misreading, the statement in lines 297-299 (left col) is just false. The issue persists in 4F. We removed “kinds of" where it appears in Sections 2E and 4E and the reference to “kinds of" in 2F (it does not appear in 4F). The lines 297-299 (in the submission 2022-20558R) seemed redundant so we removed them. • A more minor point: sometimes terms of art are used without definition in the main article, while the SI contains a few words of explanation. "Coarsening" is an example. When these terms are used in the main article, either provide those brief explanations or point the reader to the relevant SI section. Sometimes there is no explanation anywhere, eg "PUMS". After the very first mention of coarsening, we added “(See SI-2 for a comparative discussion)” at lines 28-29. For PUMS, which is used in a direct quotation, and we added clarifications as follows in lines 157-159: “in past censuses, it was possible to create a PUMS-like [Public-Use Microdata Sample] file from the SF1 tables [i.e., decennial census publications]. It was just a pain in the neck.” • An additional desideratum that should be considered is that of being “future-proof." Methods that require the curator to consider the risk in light of existing external sources of information are not robust to the release of new datasets by third parties. This is a great point. We feel it fits in the broader topic of 2K: Resilience to Misspecification, and so we added at lines 449-451: “What if the assumptions are wrong or obsolescent (e.g., when new external datasets become available in the future)?” \itemMost striking is that the original 2006 paper by Dwork, McSherry, Nissim, and Smith in which differential privacy is defined, is not cited! Fixed! We added both Dwork 2006 and Dwork et al. 2006. It's the former paper that introduces the term “differential privacy.” \itemThe references are a bit odd, citing later papers when earlier papers made similar points Often we are looking for the papers with the strongest or most in-depth examination of a specific point (due to PNAS limitations on references). For example, the counterfactual methodology of differential privacy is considered in depth in a much later paper, however, we did add the citations to Dwork (2006), where the term differential privacy is first used, and Dwork, McSherry, Nissim, Smith (2006), where “indistinguisability” is defined and the running example is a census of population. The referee is correct that their omission is notable. \itemIn the right column, lines 275-278, you suggest allowing individuals to conduct research in an FSRDC and then publish the results using differential privacy. If the research within the FSRDC is not done in a differentially private way, then this is problematic, as the choice of calculation to be released (with DP) may depend crucially on the data of a single individual in a non-private way. This is known as the “Fienberg Problem". This is a good point that should be unswept from under the rug. We appended the following sentence at lines 279-281: \emph{Note, however, that quantifying privacy loss due to exploratory analysis of raw data, known as the “Fienberg Problem” (25) is an open research question.} Citation 25 is now the one suggested by the referee. • \textbf{Line 323: should “possible" be “impossible"?} “Impossible" is correct. Thanks for catching that (now at line 322).