Disclosure risks for microdata

In this paper a model is developed for assesing disclosure risks of a microdata set. It is an extension of the one presented in Bethlehem et al. (1988). It is used to calculate (an upper bound of) the risk that an investigator is able to reidentify at least one individual in an anonimyzed data set, and hence discloses some sensitive information about him. This risk is shown to depend on, among other things, two variables which can be controlled by the statistical office which is disseminating such a data set: the 'coarseness' of the key variables and the size of the data set. The model yields guidelines as to the usage of these two instruments to control the disclosure risk.