Technical Summary: A Roadmap for Greater Public Use of Privacy-Sensitive Government Data

Problem Statement

Government agencies manage voluminous datasets with significant potential for research, economic development, and evidence-based policy making. However, the dissemination of these datasets is severely constrained by concerns regarding the privacy of individuals and organizations. Data sensitivity arises from individual privacy (risk of re-identification or misuse when combined with other sources), corporate confidentiality, and political sensitivity (potential for misinterpretation).

Beyond privacy, broader data sharing faces impediments including regulatory restrictions, technological barriers (formatting and storage), and budget constraints (lack of metadata). While private enterprise has advanced rapidly in creating large datasets, government data sharing lags due to the high stakes of privacy loss and the complex trade-offs between utility and disclosure risk. Existing fora often focus narrowly on either technological solutions or specific policy aspects, lacking a holistic approach to the impediments preventing broader public use of government data.

Methodology

This paper reports on a two-day virtual workshop held on May 21 and 26, 2021, sponsored by the National Science Foundation (NSF), the National Institute of Standards and Technology (NIST), and the White House Office of Science and Technology Policy. The workshop convened 40–50 invited participants, primarily from Federal Government agencies, alongside academics and practitioners with expertise in policy and technology.

The methodology employed a structured discussion format:

• Day 1: Focused on use cases (successful and unsuccessful) to illustrate challenges and research ideas. Topics included confidentiality-utility trade-offs, differential privacy in practice, cryptographic security, synthetic data generation, and secure multiparty computation.
• Day 2: Consisted of breakout group brainstorming sessions and full-session discussions to identify specific challenges and promising directions. Breakout topics included Stakeholders, Methods, Equity, Problems and Challenges, Research Agendas, and Unspoken Issues.

The report synthesizes the discussions from these sessions to identify unmet needs, limiting issues, and technological/policy gaps. It does not present new experimental data or a single unified technical solution but rather aggregates the collective insights of the participants to form a roadmap.

Key Contributions and Identified Challenges

The workshop identified five specific challenges and corresponding areas for action:

1. Test-beds for Privacy-Aware Data Sharing

There is an urgent need for realistic evaluation test-beds to provide insight into the pros and cons of different technologies.

• Public Test Datasets: The report discusses the difficulty of releasing real data due to sensitivity. It suggests synthetic data as a viable alternative that can serve as "ground truth" and be manipulated to simulate real-world challenges (e.g., missing values, bias).
• Controlled Access: Mechanisms such as virtual enclaves (e.g., All of Us Program) and physical enclaves (e.g., Federal Statistical Research Data Centers) allow researchers to access restricted data under strict supervision.
• Community Challenges: Competitions like the NIST Differentially Private Synthetic Data Challenge and iDASH are highlighted as effective ways to advance state-of-the-art methods and evaluate technology communication.

2. Stakeholder Engagement

Effective data sharing requires coordinated engagement among diverse stakeholders: data subjects, data users, data stewards, mechanism developers, and policymakers.

• Trust and Transparency: A culture of trust is essential. Data users must understand how data will be used, and stewards must be transparent about privacy protection methodologies (e.g., explaining noise injection or bias).
• Incentive Structures: Incentives are critical for participation. The report notes that without clear guarantees of privacy-preserving usage, participation rates (e.g., in FCC speed tests or agricultural data collection) may decline.
• Championing: Non-technical issues (legal, political) often pose significant barriers; identifying champions within agencies is necessary to deploy privacy solutions.

3. Equity

Current disclosure limitation mechanisms can disproportionately impact minority populations.

• Representation Inequities: Methods like suppression or differential privacy can reduce the accuracy of analyses for small populations, leading to systemic biases in resource allocation.
• Re-identification Risks: Individuals in small demographic groups face higher re-identification risks, disproportionately burdening historically disadvantaged groups.
• Variable Fidelity: The report proposes "variable fidelity methodologies," where disclosure control methods allow for different levels of data fidelity for different groups (e.g., generalizing age for a rare demographic while keeping it specific for a majority group) to balance privacy risk and data utility.
• Small-Area Estimation: Techniques like small-area estimation are suggested to improve precision for small subpopulations, though their validity under privacy constraints requires further research.

4. Technology Communication

There is a gap between privacy theory and practical deployment in the government sector.

• Contextual Differences: Government data collection is often mandated, unlike commercial collection where users can opt-out. This necessitates a higher standard of trust and protection.
• Guidance: Agencies need clear guidelines and standards to select appropriate privacy solutions for specific use cases, moving beyond theoretical frameworks to practical, measured solutions that balance privacy and utility based on well-understood risks.

5. Methods for Privacy-Preserving Data Sharing

The report distinguishes between privacy of the output (e.g., differential privacy, statistical disclosure limitation) and privacy of the computation (e.g., fully homomorphic encryption, secure multiparty computation).

• Matching Methods to Needs: Existing frameworks often lack easily interpretable guarantees, making it difficult for agencies to choose methods. The report suggests "fitness-for-use" models where utility constraints are inputs to infer private release strategies.
• Implementation Burdens: A gap exists between theoretical algorithms and practical implementation (e.g., floating-point arithmetic issues in differential privacy).
• Multi-tiered Access: Systems offering different access levels (e.g., public synthetic data vs. enclave access for trusted researchers) introduce complex policy and risk modeling challenges regarding resource allocation (e.g., privacy budgets).

Results and Actionable Items

The workshop did not arrive at a formal set of recommendations but captured key actionable items to advance the field:

• Community Building: Organize conferences and workshops to foster discussion and demonstrate solution deployment.
• Research and Development: Pursue both foundational and applied research.
  • Applied: Develop application-oriented data releases, modular interfaces for privacy-preserving analysis, and verification servers for synthetic data.
  • Foundational: Create algorithms for quality assessment without raw data access, develop principled metrics for privacy leakage and identifiability, and build taxonomies for private data.
• Common Repositories: Develop repositories with diverse data sharing use cases (e.g., the Differential Privacy Synthetic Data Challenge) to stimulate research.
• Stakeholder Education: Educate individuals from various disciplines to understand privacy issues, data-sharing constraints, and the technologies involved.
• Communication of Risks and Benefits: Clearly communicate the limitations and constraints of technologies to build communities around specific use cases.

Significance

The paper positions itself as a roadmap derived from a multidisciplinary dialogue between government data stewards and researchers. Its significance lies in:

1. Bridging the Gap: It highlights the disconnect between academic privacy research and the practical, policy-driven needs of government agencies.
2. Holistic View: It moves beyond purely technical solutions to address the "unspoken issues" of equity, stakeholder trust, and the specific ethical constraints of government data.
3. Identifying Open Challenges: It explicitly lists research agendas, such as the need for variable fidelity methodologies, better risk measurement in multi-tiered systems, and the development of tools to characterize the impact of privacy techniques on data equity.
4. Modest Claims: The authors acknowledge that the workshop did not produce a definitive solution but rather identified a set of unmet needs and promising directions. The report serves as a call to action for the community to address these impediments through coordinated research, policy development, and community building.