Data products · Privacy design · Analytics
How can new dashboard filters change privacy risk?
Review the combinations and repeated views a report makes possible, then validate privacy protection and usefulness across the whole release.
Review what the interface lets people infer
An aggregate dashboard can become more revealing when a new filter narrows a group or makes overlapping views comparable. Review the information a user can obtain across the interface, including exports and earlier releases. A single safe-looking screen is an incomplete test.
NIST’s de-identification guidance for government datasets explains that information from multiple releases can accumulate. Apply that lesson when adding a category, drill-down or time comparison: consider the new set of reachable outputs, even if no underlying questions have changed.
Include people with relevant statistical and privacy expertise in the design review. Describe the intended audience, permitted uses and plausible background knowledge. Those conditions help determine what protection is needed; the label aggregate does not establish anonymity.
Choose controls for the whole reporting design
Clarify which distinctions users need to make the intended decision. Broader categories or less granular time periods may preserve that usefulness while reducing exposure. Evaluate these options before offering every possible combination of dimensions.
For Census 2021, the Office for National Statistics combined several disclosure-control methods with rules limiting the datasets its table builder could produce. Its account illustrates why output flexibility and privacy protection must be designed together. Its particular thresholds are not universal settings for other dashboards.
Check that protection remains consistent across charts, downloads and related reports. A restriction in one view can be undermined by another output. Have specialists evaluate combinations and cumulative disclosure rather than assuming a minimum group-size rule is sufficient everywhere.
Validate both protection and usefulness
Test the implemented reporting paths, not only the proposed rules. Include empty categories, rare combinations, changes over time and the outputs available to different roles. Keep the review grounded in the actual data and release context without distributing unnecessary personal information.
NIST recommends validating both the privacy protection and the usefulness of de-identified data. If a control changes counts or removes detail, explain the consequences for interpretation. Avoid presenting protected figures with a precision or comparability that the method cannot support.
Assign an owner to reassess changes in filters, audiences and releases. Keep a record of what has already been made available so future decisions consider that history. Privacy protection is a property of the reporting system and its use, rather than a one-time checkbox on a dataset.