This memorandum documents requirements the 2020 Census Program has received from the Data Stewardship Executive Policy Committee (DSEP) regarding how to protect the information we collect from the American public during the 2020 Census. DSEP has instructed us to apply differentially private disclosure avoidance methods to all of the statistics we produce from these data, starting with data collected during the 2018 End-to-End Census Test. DSEP will manage the amount of privacy loss associated with the 2020 Census data products, called the “privacy-loss budget,” and make policy decisions regarding the design of the 2020 Disclosure Avoidance System (DAS). I will communicate these policy decisions and their associated requirements as we receive them from DSEP through the 2020 Census Memorandum Series.

The Census Bureau has continually added better and stronger protections to keep the data it publishes anonymous and underlying records confidential. Historical methods, including data swapping, cannot completely defend against the threats posed by today’s technology. Enough noise must be added to protect confidentiality, but too much noise could damage the statistics’ fitness-for-use. To help prevent anyone from tracing statistics back to a specific respondent, we will alter the underlying statistical tabulations before publication using a new method, called differential privacy, for the 2020 Census. This new, advanced, and far more powerful confidentiality protection system uses a rigorous mathematical process that protects respondents’ information and identity by injecting random noise into the tabulations. Differential privacy provides a way to control the tradeoff between noise and accuracy by creating a mathematical relationship between the noise added, the resulting privacy loss, and the resulting accuracy. It is also called "formal privacy" because it provides provable mathematical guarantees about the confidentiality protections that can be independently verified without compromising the underlying protections. Differential privacy is based on the cryptographic principle that an attacker should not be able to learn any more about an individual from the statistics the Census Bureau publishes using an individual’s data than from statistics that did not use an individual’s data.

On April 5, 2019, DSEP reviewed a recommendation made by the Chief Scientist and Associate Director for Research and Methodology, and the 2020 DAS team. Based on this recommendation, DSEP decided that the Census Bureau will not apply any statistical disclosure avoidance to the total state resident and the federally affiliated count overseas (FACO) populations in all of the 2020 Census data products. The Census Bureau will report these figures exactly as we have enumerated them.