Privacy, Confidentiality, and Trust: Lessons from the Debate on Census Microdata for the Future of Official Statistics

Abstract

The adoption of differential privacy by the U.S. Census Bureau for the 2020 Census and the debate over the possible replacement of public-use microdata from the American Community Survey (ACS) with synthetic data constitute one of the most significant debates in the recent history of official statistics. This viewpoint reconstructs the positions of John M. Abowd and the Census Bureau, as well as the criticism expressed by Steven Ruggles and the user community, while also examining institutional developments in the United States during 2025–2026 and the new dissemination architecture for microdata from the 2022 Demographic Census sample produced by the Brazilian Institute of Geography and Statistics (IBGE). The controversy should not be reduced to a choice among anonymization techniques. At stake, alongside the question of which populations and statistical relationships will remain visible, is the institutional decision concerning who defines the boundaries between risk and utility. Technical uncertainty is real and requires empirical assessment, intruder testing, and thorough documentation. A loss of trust in the data-producing institution represents a significant risk, since official statistics tend to be used without the possibility of direct verification. In my view, the most appropriate approach would be a product-by-product architecture combining risk-proportional protection with tiered access and independent evaluation, alongside documented user participation. The decisive criterion should not be the choice of a particular method, but rather the ability to make auditable the trade-off between protection, scientific utility, and institutional legitimacy.