Statistical Disclosure Control & Privacy-Safe Education Reporting

HEW-NODE-0167 · How Education Works · statistical disclosure control, education statistics, privacy-safe reporting, small cells, indirect identification, re-identification risk, suppression, complementary suppression, aggregation, rounding, perturbation, microdata, secure research access, output checking, public dashboards, geospatial reporting, synthetic data, disclosure risk and statistical utility

A table can contain no names and still identify a child.

Imagine a public school dashboard showing attendance for every combination of school, grade, sex and disability status. In one small rural school there is only one girl with a particular disability in Grade 8. The dashboard reports 100 per cent attendance for that group.

The table contains no name, address or student number. Yet anyone who already knows who the learner is can infer something about her attendance. If another table reports disciplinary incidents, examination outcomes or support needs at the same level of detail, the privacy risk grows again.

Removing names is only the beginning of privacy-safe statistical reporting. The harder question is whether the remaining detail can still reveal a person through what others already know.

This node sits beside the How Education Works hub, Education Open Data, Public Reporting & School Transparency, Education Data Privacy & Student Records Governance, Education Statistics Quality Assurance & Data Validation, Learner Identity & Education Data Interoperability, and National Learning Assessment Systems.

Those pages keep their jobs. Open Data owns why and how education evidence becomes public. Data Privacy owns lawful, proportionate handling of learner records across the system. Statistics Quality owns whether the published numbers are accurate and methodologically defensible. Learner Identity owns identity continuity across systems. National Assessment owns assessment-system evidence. This node owns a narrower release-control problem: how statistical outputs are examined and transformed before publication so useful education evidence can be shared while the risk of identifying individual learners, staff or other protected units is reduced to an acceptable level.

The 60-Second Read

Names are direct identifiers, but combinations such as school, age, sex, programme and rare condition can act as indirect identifiers.
Statistical disclosure control, or SDC, focuses on the risk that a released output reveals information about a protected statistical unit.
Security protects data from unauthorised access; disclosure control protects outputs that are intentionally released.
A numerically correct table can still be unsafe to publish.
Small cells create risk because a count of one or two may effectively point to known individuals.
Suppressing one small cell may be insufficient if totals allow the hidden value to be calculated by subtraction.
Complementary suppression hides additional cells so primary suppression cannot be reversed.
Aggregation can reduce disclosure risk by combining categories, ages, grades, schools or geographic areas.
Rounding and perturbation can reduce precision enough to protect confidentiality while retaining analytical value.
A percentage without its denominator can conceal both statistical instability and disclosure risk.
Repeated releases can be combined. A safe table today may become unsafe when compared with another release tomorrow.
Interactive dashboards need query controls because users can deliberately submit overlapping queries to reconstruct hidden values.
Maps can create disclosure risk when geography is fine enough to isolate a small population.
Pseudonymisation is not the same as anonymisation. Replacing a name with an ID does not make microdata safe for public release.
Research access can be tiered: public aggregates, public-use files, scientific-use files and secure environments can carry different levels of detail.
Synthetic data can support exploration but may not preserve every analytical property of the real data.
Over-suppression damages transparency, research and accountability; privacy protection should be proportionate.
Disclosure risk depends on what a plausible intruder could combine with the released statistics, not only on what is inside one file.
Output checking should be documented and reproducible.
The goal is not to hide education. It is to publish evidence without turning transparency into exposure.

One-Sentence Definition

Statistical disclosure control is the set of methods and governance processes used to assess and reduce the risk that published statistics or research outputs reveal confidential information about identifiable individuals or other protected statistical units.

The First Distinction: Direct Identification Is Not the Only Identification

A dataset that contains a learner’s name is directly identifying. Remove the name and the risk may fall sharply, but it does not necessarily disappear.

Eurostat explains that people can be identifiable through combinations of indirect identifiers such as age, sex, nationality and education. In a school setting, the relevant combination can be even more specific: school, grade, programme, disability category, migration status, language group, residential area or a rare examination pathway.

The practical question is therefore not “Did we remove names?” but “Could somebody reasonably recognise the person represented by this record or cell?”

The Second Distinction: Data Security Is Not Statistical Disclosure Control

Security controls who can enter the database. Encryption, identity management, role-based access, logging and secure storage reduce unauthorised access to confidential records.

Statistical disclosure control deals with a different moment: the organisation intends to release an output. The table, chart, map, download, research result or query response may be technically public by design. SDC asks whether that intended output still exposes confidential information.

The Office for National Statistics makes this boundary explicit in its current disclosure-control policy: the policy concerns statistical and research outputs rather than the physical security arrangements protecting the underlying records.

The Third Distinction: Correct Statistics Can Still Be Unsafe Statistics

A table can be perfectly accurate and still disclose a learner. Data-quality assurance asks whether the number is correct. Disclosure control asks whether publishing the number at that level of detail is safe.

The two controls should not be confused. A corrected small cell may become more accurate and simultaneously more identifying.

Official Statistics Treat Confidentiality as a Core Principle

Eurostat describes statistical confidentiality as a fundamental principle of official statistics: information on individuals or business entities collected for statistical purposes must be protected against disclosure. Its current microdata guidance distinguishes direct identifiers from combinations of indirect identifiers and applies protective recoding and access controls before data are released to researchers.

The ONS likewise requires published statistical outputs to be assessed for disclosure risk and protected using proportionate disclosure-control methods. Its policy also requires an audit trail of disclosure-control decisions, recognising that confidentiality protection is a governed publication decision rather than an informal final check.

Define the Unit You Are Protecting

Education statistics can contain several protected units:

individual learners;
individual teachers or staff;
households;
schools or providers where confidential commercial or regulatory information applies;
small cohorts whose members are readily known;
individual examination candidates;
individual respondents to surveys.

The disclosure rule depends partly on the unit. A public school’s total enrolment may be intended to be public, while a single learner’s disability status is not.

Define the Sensitive Attribute

Identification risk becomes more consequential when the released statistic reveals a sensitive attribute. In education this can include:

special educational needs or disability;
disciplinary status;
safeguarding information;
migration or refugee status where sensitive;
poverty or social-protection status;
health-related support;
individual examination performance;
attendance problems;
withdrawal or dropout;
participation in highly specialised programmes.

A count of one is not equally risky in every table. Sensitivity and identifiability need to be considered together.

The Small-Cell Problem

A school-level table reports three learners in a rare programme. Local families may know who they are. If the table then reports that two passed and one did not, the result of an identifiable learner may become inferable.

Small-cell rules reduce this risk by suppressing or modifying cells below a defined threshold. The threshold itself is not universal. It depends on legal rules, sensitivity, release context, intruder assumptions and the wider table structure.

A Threshold Is Not a Complete Disclosure-Control Policy

A rule such as “suppress counts below five” sounds simple. It can fail when the hidden value can be reconstructed from totals, percentages, neighbouring tables or repeated releases.

The real control problem is relational: what can be inferred from all the outputs a user can combine?

Primary Suppression Hides the Unsafe Cell

If a school has two learners in a sensitive subgroup, the subgroup result can be replaced with a suppression symbol rather than the exact count or percentage.

This is primary suppression: the directly risky cell is withheld.

Complementary Suppression Prevents Back-Calculation

Suppose a row contains three programme categories with counts 20, 15 and suppressed, while the total is 37. The hidden value is obviously 2.

Complementary or secondary suppression hides one or more additional cells so the sensitive value cannot be reconstructed simply from published totals.

This is why disclosure control often feels counter-intuitive: the system may need to hide a perfectly safe cell to protect another unsafe one.

The Percentage Problem

“50 per cent passed” sounds like a stable statistic. If the denominator is two learners, the percentage effectively reveals one person’s outcome. If the denominator is two hundred, the disclosure risk and statistical stability are very different.

Privacy-safe reporting should therefore consider numerator and denominator together. Publishing only percentages can conceal the small-cell problem rather than solve it.

Dominance Can Matter Even When the Cell Is Not Small

In some statistical domains, a cell can contain several contributors but one contributor accounts for most of the value. The same principle can appear in education when one provider or one tiny subpopulation dominates an aggregate.

Disclosure assessment should ask whether an aggregate effectively reveals one unit, not only how many units contributed.

Differencing Attacks Use Two Safe-Looking Tables

Suppose one report gives the examination pass rate for all Grade 12 learners in a school. Another gives the pass rate excluding one specialised programme. If that programme contains only one or two learners, subtraction may reveal their result.

Each table can look safe in isolation. The disclosure appears only when they are combined.

Repeated Releases Accumulate Information

A monthly dashboard may publish safe aggregates. Over twelve months, small changes can reveal when a particular learner entered, left or changed status.

Disclosure review should therefore consider release history and versioning, not just the newest output.

External Information Changes the Risk

A stranger may not know who attends a rare programme. A classmate, neighbour or local official may know exactly who does. Social media, school newsletters, competition lists and public profiles can add information not contained in the statistical release.

The plausible intruder model asks what a motivated user could reasonably know or obtain outside the dataset.

Maps Can Identify Through Geography

Education maps are valuable for planning access, school capacity and service gaps. Fine geographic detail can also isolate a household or a tiny group.

A map showing the exact location of learners in a rare support programme can be more identifying than a table. Privacy-safe geospatial reporting may use larger areas, jittered points, density surfaces or school-level rather than household-level geography depending on the public purpose.

Aggregation Trades Detail for Protection

Instead of publishing results for every age, combine ages into bands. Instead of village-level data, publish district data. Instead of separating five rare support categories, publish a broader support group where analytically acceptable.

Aggregation reduces uniqueness but also reduces analytical resolution. The decision should preserve the level of detail needed for the public question while avoiding detail whose main effect is exposure.

Recoding Can Reduce Identifiability

Eurostat’s public guidance describes microdata protections such as top-coding age and grouping years or geographic categories. The principle is straightforward: values that make one person unusually distinctive can be converted into broader categories.

In education, exact age in months might become age band; exact home location might become region; a rare country of origin might become a broader grouping if the detailed value is unnecessary for the intended analysis.

Rounding Reduces Exactness

Counts can be rounded to a base such as three, five or another defined rule. A value of 47 may become 45 or 50 depending on the method.

Rounding is useful because many public questions do not require exact unit counts. The trade-off is that totals may no longer add perfectly, and users need clear notes explaining that small arithmetic inconsistencies are a privacy feature rather than an error.

Perturbation Adds Controlled Uncertainty

Another family of methods modifies released values by small controlled amounts so exact underlying counts cannot be recovered easily. The statistical pattern is preserved approximately while exact cell values become uncertain.

Perturbation requires careful design because the noise itself can distort small groups or trend interpretation. Users should understand the release method well enough to avoid false precision.

Top-Coding and Bottom-Coding Protect Extreme Values

An exact age, household income or travel distance can make a record unique. Top-coding replaces all values above a threshold with a shared category such as “80 and above.” Bottom-coding can do the same at the lower end.

The technique is more relevant to research microdata than ordinary school dashboards, but the same principle applies: extreme values often carry disproportionate identification risk.

Sampling Can Reduce Exposure

A public-use microdata file can contain only a sample of the underlying population. If the sampling design and released variables are appropriate, this can reduce certainty about whether a known person appears in the file.

Sampling alone does not guarantee anonymity. Rare combinations can remain identifying.

Pseudonymisation Is Not Anonymisation

Replacing “Alicia Tan” with “Student 7F3A2” protects the direct name. If the file still contains school, date of birth, sex, rare programme, detailed postcode and examination results, someone with outside knowledge may still identify Alicia.

Pseudonymised records can be useful inside controlled environments because identities are separated from analytical data. They should not automatically be treated as safe public microdata.

Anonymisation Is a Risk Judgement, Not a Delete-Name Button

Whether data are effectively anonymous depends on what remains, what other information is available, how the data will be accessed and how plausible re-identification is in that context.

That is why official-statistics systems use several protection layers rather than relying on one field removal.

Tiered Access Preserves More Utility

Not every dataset needs to be either fully public or completely closed. A mature education statistics system can use access tiers:

Public aggregate statistics: broad tables, charts and dashboards designed for general users.
Public-use microdata: heavily protected files with reduced detail.
Scientific-use files: richer microdata available to approved research organisations under agreements and controls.
Secure research environments: highly detailed data accessed in controlled settings without unrestricted copying.
Remote execution: researchers submit code or queries and receive checked outputs rather than raw confidential records.

Eurostat’s current microdata model uses controlled researcher access for confidential microdata rather than treating detailed individual records as ordinary public data.

Secure Environments Shift the Control Point

If researchers work inside a secure enclave, they can use more detailed data without removing the data from the controlled environment. The main release-control problem becomes the researcher’s output: tables, coefficients, charts and extracts must be checked before they leave.

This can preserve analytical value while controlling disclosure risk more tightly than publishing a heavily altered file.

Output Checking Is Its Own Professional Task

A regression coefficient can sometimes disclose information if it is based on one or two observations. A minimum or maximum can reveal a unique value. A residual plot can expose outliers. A frequency table can recreate small cells.

Output checkers therefore need statistical judgement, not merely a checklist for obvious counts.

Interactive Dashboards Create a Query Problem

Static tables can be reviewed before release. Interactive systems let users generate thousands of combinations. A user might query all learners in a school, then all except one group, then infer the excluded group by subtraction.

Controls can include minimum query thresholds, limited combinations, suppression across linked queries, query-history checking, rate limits or privacy-preserving query mechanisms.

Query Rules Should Consider History

A query can be safe alone and unsafe after ten related queries. Interactive systems should not evaluate every request as if the user had no prior answers.

Differential Privacy Is One Advanced Approach

Differential privacy is a mathematical framework designed to limit how much the presence or absence of one individual can change released information. In practical systems, carefully calibrated random noise can be added while a privacy budget tracks cumulative information release.

This is a powerful approach in some high-volume statistical systems, but it is not a universal requirement or an automatic substitute for governance. Education agencies should use it only when they have the statistical expertise, product design and public communication needed to manage its trade-offs.

A Privacy Budget Is Not a Financial Budget

In differential-privacy systems, the privacy budget describes how much cumulative information leakage the mechanism permits across queries or releases. More detailed accuracy generally consumes more of that budget.

The concept is useful even outside a formal differential-privacy implementation: repeated releases consume privacy in the practical sense that each output reveals additional information.

Synthetic Data Can Support Exploration

Synthetic data are artificial records generated to reproduce selected statistical patterns of a real dataset without simply copying the original individuals.

They can help researchers learn a data structure, develop code or explore possible analyses before seeking secure access to the real data.

Synthetic Does Not Mean Automatically Safe or Analytically Equivalent

A synthetic generator can accidentally reproduce rare real records if poorly designed. It can also fail to preserve important correlations, tail behaviour or subgroup structure.

Synthetic data therefore need both disclosure evaluation and analytical validation. They are a tool, not a magic anonymisation label.

Over-Suppression Has Real Costs

If every small school disappears from public statistics, rural inequality can become invisible. If disability categories are always aggregated, policy failures affecting one group may be impossible to detect. If examination data are so rounded that year-to-year changes vanish, accountability weakens.

ONS policy explicitly recognises the balance between confidentiality and statistical utility. The objective is appropriate and proportionate risk reduction, not elimination of all useful detail.

Start With the Public Purpose

Before choosing a disclosure-control method, ask what the release is for.

Do parents need school-level enrolment?
Do researchers need learner-level longitudinal relationships?
Do planners need neighbourhood-level demand?
Do journalists need national trends?
Do civil-society organisations need subgroup inequity measures?
Do schools need their own unsuppressed operational data through an authenticated portal?

The same data can justify different release channels because the users, purposes and safeguards differ.

Data Minimisation Applies to Outputs Too

If the public question can be answered with district-level aggregates, there may be no reason to publish exact household coordinates. If age bands answer the policy question, exact birth date is unnecessary.

Useful transparency is not maximum granularity. It is sufficient granularity for legitimate use.

Build a Disclosure-Risk Assessment

What statistical unit could be exposed?
What attribute is sensitive?
Which direct identifiers have been removed?
Which indirect identifiers remain?
How small are the cells?
How unique are the combinations?
What public information could an intruder link?
How sensitive is the outcome?
How wide is the audience?
Can users download the full output?
Can users make repeated queries?
What earlier releases can be combined?
What harm could follow from re-identification?
What public value would be lost by stronger protection?

The assessment gives disclosure control a reasoned basis instead of reducing it to an unexplained cell threshold.

A table that is acceptable inside an authenticated ministry environment may not be appropriate on an open website. Release context is part of the disclosure judgement.

Separate Operational Access From Public Statistical Access

A principal may need identifiable attendance records to support learners. A national public dashboard does not. The operational system can provide legitimate role-based access while the public statistical product uses protected aggregates.

This is where the Education Data Privacy & Student Records Governance boundary matters: statistical disclosure control does not replace lawful operational access controls.

Protect Rare Categories Without Erasing Them From Policy

A rare disability category may be too identifying at one-school level but essential for national planning. The answer can be different granularity at different levels: suppress school-level figures while retaining district or national aggregates and secure analytical access.

Use Hierarchical Release Rules

A system can specify that school-level data require larger cells, district-level data can carry more subgroup detail, and national statistics can publish the fullest aggregate breakdown.

The hierarchy reflects how identifiability changes as the population grows.

Check Derived Measures

Disclosure can appear in ratios, rates, indexes, percentiles, growth measures and differences even when raw counts are hidden. If a rate is computed from a denominator of one, the output can reveal an individual outcome.

Output checking should examine the derivation chain, not merely visible count columns.

Check Confidence Intervals and Error Bars

Very narrow uncertainty intervals can sometimes reveal more about small underlying samples than intended. Conversely, omitting sample size can make unstable statistics look more reliable than they are.

Statistical quality and confidentiality should therefore be reviewed together at the publication stage even though they solve different problems.

Check Extremes and Rank Tables

A “top ten schools” table can expose a small subgroup if one ranking metric is based on a handful of learners. Minimum and maximum values can identify unique cases even when averages are safe.

Rankings also create separate validity problems, which the Education Open Data, Public Reporting & School Transparency owner addresses more broadly.

School-Level Examination Reporting Needs Particular Care

A school with eight candidates in an advanced subject may be easily interpretable locally. Publishing grade distributions could reveal individual performance, especially if award ceremonies, subject lists or social media already identify candidates.

Possible controls include minimum cohort sizes, grade-band aggregation, multi-year pooling or limiting detailed results to authenticated school users rather than public release.

Disciplinary and Safeguarding Statistics Need Higher Caution

A public count of one safeguarding incident in a small school may be highly sensitive because the involved learner can be known in the community. The public-interest case for school-level disclosure should be weighed against potential harm.

Aggregated national or district reporting can often preserve accountability without exposing a child.

Staff Statistics Can Identify Adults Too

Education privacy is not only about students. A small school may have one principal, one counsellor or one teacher in a specialised subject. Publishing detailed absence, disciplinary or performance-related information by role can identify staff members even without names.

Longitudinal Data Increase Analytical Power and Disclosure Risk

Following learners across years helps researchers study progression, dropout and later outcomes. The same longitudinal detail creates distinctive trajectories that can make people easier to identify.

Rich longitudinal microdata are therefore often better suited to secure research access than unrestricted public files.

Record Linkage Changes the Threat Model

A file that is safe alone can become identifying when linked with another dataset. School, age, location and programme information might connect to public competition results, local news or another government release.

Disclosure assessment should consider realistic linkage sources, not assume the education dataset will be viewed in isolation.

Publication Metadata Can Leak Information

File names, hidden spreadsheet tabs, chart tooltips, comments, document properties and downloadable source data can expose detail that the visible table hides.

Release checking should include the actual public artefact, not only the statistical table before formatting.

Version Control Matters

If a protected table is corrected later, the replacement release should preserve the disclosure rules. A hurried correction can accidentally restore unsuppressed detail or make differencing against the previous version possible.

Release history should therefore be part of the disclosure-control review.

Corrections Need a Disclosure Re-Check

A statistical correction is not merely a data-quality event. Changed values can alter cell sizes, dominance, derived percentages or suppression requirements. Corrected outputs should pass the same disclosure gate as first publication.

Publish the Method Without Publishing the Secret

Users should understand that counts are rounded, cells suppressed or noise added. Transparency about method supports correct interpretation.

But a disclosure-control policy should not reveal operational detail that makes attacks easier. The right level of method disclosure depends on the mechanism and threat model.

Stable Rules Improve Comparability

If one year suppresses counts below five and the next year uses a different unexplained rule, apparent changes in data availability can be mistaken for real changes in education conditions.

Method changes should be documented and, where possible, historical series should be interpreted consistently.

But Rules Must Be Reviewed as Data Environments Change

New public datasets, richer administrative linkage and more powerful analytics can increase re-identification risk. A rule that was proportionate ten years ago may no longer be sufficient.

Build Separation of Duties Into Release

data producer prepares the statistics;
methodologist checks statistical validity;
disclosure-control reviewer assesses confidentiality risk;
publication owner checks communication and release format;
authorised officer approves exceptional high-risk releases.

Small organisations may combine roles, but high-risk outputs should not depend entirely on one person’s unchecked judgement.

Keep an Audit Trail

dataset version;
planned release;
protected statistical unit;
identified disclosure risks;
method applied;
parameters used;
cells or outputs modified;
reviewer;
exceptions approved;
release date;
later incidents or complaints;
method revisions.

ONS policy explicitly requires a proportionate audit trail of disclosure-control decisions. Education agencies benefit from the same discipline because later questions often depend on reconstructing why a particular cell was hidden or altered.

Use an Exception Process for High Public Interest

Occasionally a statistic has unusually high public value but difficult disclosure risk. The solution should not be an informal override.

An exception route can require senior review, legal advice where relevant, alternative aggregation tests, harm assessment and explicit documentation of the decision.

Complaints and Incidents Should Feed Back Into Policy

If a family reports that a published table effectively identified a child, the agency should investigate the release chain, remove or amend the output where appropriate and update disclosure rules if the failure was systemic.

Incident learning matters because disclosure control operates under uncertainty. Near misses reveal assumptions that need repair.

Case Study: The Tiny Disability Subgroup

Illustrative example: a public dashboard reports examination outcomes by school, grade, sex and disability type. One school has two girls in a particular support category. Local families know both learners.

The system suppresses the subgroup result at school level, retains the category in district and national reports, and allows authorised analysts to study the detailed data in a secure environment. The learners do not disappear from policy simply because the public table is coarser.

Case Study: The Hidden Cell That Was Not Hidden

Illustrative example: a table lists 18 learners in Programme A, 12 in Programme B, suppresses Programme C and gives a total of 32. Anyone can infer that Programme C contains two learners.

The revised release suppresses an additional safe cell and adjusts row totals according to the disclosure method. Complementary suppression protects the primary cell from arithmetic reconstruction.

Case Study: The Two Safe Reports

Illustrative example: a ministry publishes school completion by grade. A second report publishes completion for all students except those in a small newcomer programme. Both releases pass separate small-cell checks.

A researcher subtracts the second table from the first and reconstructs the small programme’s result. The ministry adds a linked-release review so future tables are assessed against previously published aggregates, not as isolated products.

Case Study: The Map That Revealed a Learner

Illustrative example: an interactive map displays exact residential points for students using a rare transport support programme. The points contain no names.

In a sparsely populated area, the household is obvious. The public product is redesigned to show aggregated demand zones. Exact coordinates remain available only to authorised transport planners.

Case Study: The Researcher Who Needed More Detail

Illustrative example: a university team wants to study how disability, school mobility and examination outcomes interact over six years. A public-use file would need such heavy recoding that the research question would become impossible.

The ministry does not publish the full longitudinal microdata. It accredits the research project, provides access inside a secure environment and checks outputs before release. The public gains research value without receiving unrestricted individual records.

Case Study: The Dashboard Query Attack

Illustrative example: a public dashboard blocks groups smaller than five. A user repeatedly changes filters, querying a school with and without one programme, one age group and one language category.

The system discovers that the threshold works only per query. It introduces linked-query controls and reduces the number of dimensions available simultaneously at school level.

Failure Modes and Repairs

Names removed, declared anonymous: repair by assessing indirect identifiers and linkage risk.
One small-cell threshold for everything: repair with risk-based rules that consider sensitivity, output structure and release context.
Primary suppression only: repair by testing whether totals or related cells reveal the hidden value.
Percentages without denominator checks: repair by testing underlying counts and instability.
Each release checked in isolation: repair by maintaining release history and differencing tests.
Map treated like table: repair by assessing geographic uniqueness.
Pseudonymised file published openly: repair by distinguishing pseudonymisation from anonymisation and using access tiers.
Maximum secrecy: repair by testing public value and avoiding unnecessary suppression.
Interactive dashboard uses static-table rules: repair with query-history and recombination controls.
No decision trail: repair with documented disclosure assessments and output checks.

The Privacy-Safe Reporting Operating Chain

Define the public or research purpose.
Identify the statistical units to protect.
Identify sensitive attributes.
Classify the release channel.
Remove unnecessary direct identifiers.
Identify remaining indirect identifiers.
Map likely external linkage information.
Assess cell sizes and uniqueness.
Assess dominance where relevant.
Check derived percentages, rates and rankings.
Check geographic detail.
Check longitudinal uniqueness.
Review prior related releases.
Test differencing and recombination risk.
Choose the least-distorting protection method.
Apply primary suppression where needed.
Apply complementary suppression where needed.
Aggregate or recode categories where appropriate.
Apply rounding or perturbation where appropriate.
Assess analytical utility after protection.
Choose a more controlled access tier if public release loses too much utility.
Review interactive-query controls where applicable.
Review downloadable metadata and source files.
Run independent output checking for high-risk products.
Document methods and parameters.
Approve justified exceptions through a controlled route.
Publish user-facing method notes.
Monitor complaints, incidents and attempted misuse.
Re-check corrected or revised outputs.
Review disclosure rules as the external data environment changes.
Feed incidents and near misses into training and policy.

A Disclosure-Control Dashboard

planned public releases;
releases requiring SDC review;
small-cell alerts;
cells primarily suppressed;
cells complementarily suppressed;
outputs aggregated;
outputs rounded or perturbed;
geospatial releases reviewed;
interactive products reviewed;
public-use microdata files;
scientific-use files;
secure research projects active;
outputs checked from secure environments;
high-risk exceptions approved;
release corrections requiring re-check;
disclosure incidents;
near misses;
complaints received;
average disclosure-review time;
next method-policy review date.

Canonical Owner Boundaries

Education Open Data, Public Reporting & School Transparency owns the policy purpose, interpretation and accountability design of public education reporting.
Education Data Privacy & Student Records Governance owns lawful, proportionate collection, use, sharing, retention and protection of learner records.
Education Statistics Quality Assurance & Data Validation owns statistical accuracy, validation, revisions and methodological quality.
Learner Identity & Education Data Interoperability owns identity continuity and interoperable records across systems.
National Learning Assessment Systems owns national assessment design, sampling, administration and trend evidence.

This node owns the output-release boundary: assessing statistical disclosure risk and applying proportionate controls before education statistics, microdata or research outputs are released beyond their controlled environment.

Sources and Further Reading

Eurostat, Statistical Confidentiality and Personal Data Protection.
Eurostat, Microdata: Overview and Research Access.
Eurostat CROS, Statistical Disclosure Control.
Office for National Statistics, Statistical Disclosure Control.

The Return Path

Return to the table showing 100 per cent attendance for one tiny subgroup.

The ministry did not publish a name. It did something subtler: it published enough context for people who already knew the learner to connect the statistic back to her.

That is the central lesson of statistical disclosure control. Privacy does not live only inside databases. It can be lost at the moment perfectly legitimate transparency becomes too precise.

A mature education statistics system therefore asks two questions before publication. First: is this evidence accurate and useful? Second: can it be released at this level of detail without turning a person into the hidden subject of a public statistic?

Privacy-safe public statistics do not hide education. They make it possible to publish evidence without turning transparency into exposure.

Return to the How Education Works hub.

How Education Works | Statistical Disclosure Control & Privacy-Safe Education Reporting — How Systems Publish Useful Detail Without Exposing Individual Learners