Accurate Linkages and Robust Privacy Protections for an Integrated System of Income, Consumption, and Wealth

Accurate Linkages and Robust Privacy Protections for an Integrated System of Income, Consumption, and Wealth Amy O’Hara1 1Georgetown University, 600 New Jersey Ave. NW, Washington DC 20001 Abstract Creating an integrated system of income, consumption, and wealth data is complex, but not impossible. Building on the recommendations in the NASEM report, I will discuss best practices in data linkage and privacy enhancing technologies that inform the project, noting the challenges and opportunities of blending population-level administrative and commercial data with survey and census data. To join restricted data from multiple government sources, privacy preserving record linkage methods and private set intersections can reduce the need for agencies to yield control over their datasets. The resulting blended data must comply with access and use restrictions for all input sources. This requires careful planning and oversight of data management, planned access modes, and allowable uses. Robust metadata is essential, noting provenance of administrative and commercial data, with documentation about derived elements for responsible research on this powerful new data system. Privacy risks can be mitigated through use of methods including synthetic data, query servers, noise infusion, and enclave access for approved, vetted users. I will describe options for tiered access, ranging from open data to restricted microdata, that align with the needs, timelines, and skillsets of approved users who need reliable estimates of income, consumption, and wealth. Key Words: Data linkage, privacy enhancing technologies 1. Introduction In the “Creating an Integrated System of Data and Statistics on Household Income, Consumption, and Wealth: Time to Build” report1 (hereafter the ICW report), we repeatedly stress the need for accurate data linkages and privacy protection due to the sensitivity of the population data being studied. Different population-level datasets from federal agencies are required for such measures. Since the report was released, new challenges have emerged regarding the stability and accessibility of these data sets, as well as the continued operation of programs that generate administrative income data. In this paper, I review changes involving data access, data linkages, and privacy among government agencies that are central to producing new measures described in the ICW report. I then describe how the panel’s assumptions about data inputs and outputs are challenged in the current political environment, and revisit our recommendations to confirm that secure, efficient methods exist to produce an integrated system of income, consumption, and wealth. 2. Data Access Regarding data access, the Trump Administration has suggested that the Bureau of Economic Analysis (BEA), the Bureau of Labor Statistics (BLS), and the U.S. Census Bureau be unified.2 This is not a new idea but would require significant reorganization and alignment of priorities. The proposal is particularly relevant to the ICW report, as data streams from each of those agencies are crucial to understanding income, consumption, and wealth. The potential consolidation of statistical activities that measure economic activity fits within broader discussions about centralizing statistical functions in the United States. There are currently 13 principal statistical agencies and many more designated statistical units. Other countries operate with a national statistics office, and the decentralized nature of statistical production in the United States hampers efforts to provide consistent definitions, obtain resources to deliver timely data products, and to conduct linkages that improve understanding of income and consumption at both the micro and macro levels. In the past, such discussions about centralization went nowhere because it was unthinkable to have such a significant upheaval of government activities and agencies. Yet here we are, in a new era of rapid change across federal government programs and agencies. Greater consolidation of statistical activities could support data access, and such efforts would be accelerated with a National Secure Data Service (NSDS). The NSDS is mentioned throughout the ICW report. An NSDS would support the discovery and deployment of best practices in data linkage and privacy protection. The NSDS would facilitate secure data access for ICW research and development, and possibly assist in tiered access for resulting statistical products (e.g., microdata, synthetic data). Yet, it is currently unclear whether such an important government-wide service (or evidence-building) is a political priority. 3. Data Linkages The ICW report assumed that linkages would be conducted by agencies using direct identifiers. In the report, we noted that privacy-enhancing technologies could make such linkages more secure. These include: privacy-preserving record linkage (PPRL), which conducts joins on hashed identifiers; private set intersections, which could enable joins between public and private sector datasets; and federated learning, which allows data sources to remain with their owners instead of being pulled into a central warehouse. Such privacy enhancing methods are more important than ever. Several of the key data sources needed for an integrated system of income, consumption, and wealth—particularly those from the Internal Revenue Service (IRS) and the Social Security Administration (SSA)—have been in the news for potentially unauthorized access and intergovernmental data transfers for enforcement (rather than statistical) purposes. By using privacyenhancing technologies, some of these risks may be mitigated by limiting control and exposure of identifying information. 4. Privacy Privacy was a key concern during the ICW panel. We reviewed threats and solutions to both input privacy and output privacy. Input privacy protections address risks to the improper access or use of input files, including direct identifiers and precise amounts or holdings that could also be uniquely identifying. Both individual and group privacy must be considered, with appropriate safeguards built into the data access, linkage, and analysis platforms to create ICW products. Output privacy refers to statistics that will be publicly released. Protocols for output review must reduce the risk of reidentification for any individuals in published data. The ICW report refers to the need for input privacy protections while measures are being designed and produced, and for output statistics and publications. To accomplish the research and development needed for ICW measures, and to provide tiered access to approved users, trusted research environments must be explored. The National Secure Data Service (NSDS) demonstration at the National Center for Science and Engineering Statistics has pilot projects developing secure test beds for such use; further investment and deployment would strongly support the ICW project. Similarly, if the proposed merger of BEA, BLS, and Census occurred, a unified compute platform could be deployed that would remove some of the technical barriers to joining data among those agencies. However, linking data to measure ICW is more than a technical issue. Legal constraints about how each bureau’s data may be used, by whom, and for what purposes, would need to be resolved. Governance could be embedded in the operation of a trusted research environment; this could accelerate research and development of ICW measures. Once measures are agreed upon and produced by government staff, data could be made available to external users, including academics, business economists, and researchers at think tanks. For these groups, secure query systems—where users never see the underlying data but can run specific queries—should be considered. Additionally, synthetic data files with corresponding validation servers could allow users to refine their analyses on synthetic data and later obtain robust estimates through validation servers. Whether results come from direct computation by an agency, a secure query system, or a validation server, all outputs for public release will need further protection including traditional disclosure avoidance methods (suppression, rounding) as well as noise infusion. 5. Revisiting Assumptions The panel studied the issues surrounding ICW measurement several years ago. We had assumed that statistical programs and government agencies would persist, and made recommendations for short-term and medium-term actions accordingly. However, some of our assumptions (listed below) need to be revisited given changes in the federal data ecosystem. 5.1 Statistical Program Stability Programs have suffered instability due to funding and staffing reductions. Public trust has declined, and three statistical agency directors have been forced out of their roles, to date. 5.2 Administrative Data Continuity The panel assumed stable streams of administrative data for linkage. However, some programs that generate these data are under threat. Staffing reductions and funding cuts have already affected the volume and coverage of administrative data at BEA. Examples from history underscore the impact of such volatility: IRS saw a decrease of 7 million dependents in 1986–87 when SSNs were required for all claimed dependents.3 IRS filings increased by 15 million between 2007–2008 due to the economic stimulus rebate distribution.4 Increases and decreases in administrative datasets causes challenges for reliable trends measuring ICW. Transparency about program changes and clear user notes are essential to explain breaks in series or convey uncertainty about trends in volatile data. Survey data also face volatility. Canada’s National Household Survey had a 25 percentage point decrease in response rates in 2011 when it became voluntary instead of a mandatory data collection.5 Bills are regularly floated in Congress to change the American Community Survey (ACS) from mandatory to voluntary. Such a change would substantially degrade information quality. Similar threats apply to the Current Population Survey, Survey of Income and Program Participation, and other household surveys. 5.3 Reliable Technical Infrastructure The ICW report assumed reliable technical infrastructure within government agencies. Recent costcutting measures have instead reduced contracts across agencies, undermining data collection, processing, and linkage capacity, as well as access to essential software and tools for analysts. 5.4 Skilled Agency Workforce The panel assumed that the outstanding, principled skilled labor in federal agencies would remain in place. That assumption has been challenged as agencies have lost significant percentages of their workforce. 5.5 Peer and User Community Engagement Advisory committees have been disbanded, and conference participation has been suspended. There is little opportunity for open dialogue with user communities at this time. It is questionable whether user community review and feedback—essential for transparency and legitimacy—can occur under current constraints. 5.6 Releasable Outputs During the project, it was assumed that linkages, aligned definitions, and new statistical series would yield new public goods that would be released to data users and policymakers. It is no longer clear that such products (if produced) would be released publicly, or whether agencies have sufficient resources and staff to conduct disclosure avoidance at the level required for ICW products. 6. Revisiting Recommendations The panel made sound recommendations in the ICW report, but as I’ve outlined above, that was a different era. I editorialize on some of the panel’s recommendations below: • Recommendation 3-1: Statistical agencies should build on their current initiatives. I hope the great work on the distribution of national accounts6 at BEA, the National Experimental Well-bring Statistics7 project at Census, and the consumption research8 at BLS can continue. • Recommendation 3-2: Produce a major report every 3 years. Looking at the magnitude of disruptions that have occurred in 2025, it is hard to imagine what agency staff and resources will remain in three years, and whether policymakers will want accurate measures of income, consumption, and wealth. • Recommendation 4-2: Produce estimates of error when combining data sources. Yes! This is good solid work that needs to keep happening, whether we have a decentralized statistical system or a unified one. I hope agencies can retain the skilled labor to keep doing this research, and also hope for the day that grant funding and partnerships with academic and private sector experts can resume so we can generate durable solutions to our measurement challenges. • Recommendation 4-3: Interagency experts working on ICW should have regular consultation with expert groups. I hope that advisory committees are relaunched to provide important feedback loops with government experts. • Recommendation 5-1: The Chief Statistician of the U.S. and the NSDS should create an ICW coordinating entity. Why stop there. They should rethink the organization of the entire Federal Statistical System, or at least work through the challenges to unify efforts at BEA, BLS, and Census. • Recommendation 6-1: Develop a risk-utility framework. This is another just-do-it recommendation that underlies population data linkages and development of products reliant on sensitive data streams (like income, consumption, and wealth). Like 4-2, this should not be affected by politics; we all need good science to proceed. • Recommendation 6-2 – Need for a restricted data access model for research using derived or linked data. We need to develop tiered access models, going beyond use of restricted microdata in a Federal Statistical Research Data Center, and not waiting for the NSDS. If we invest in ICW, we need to maximize its utility. • Recommendation 6-3: The Chief Statistician of the U.S. and the Interagency Council on Statistical Policy (ICSP) should establish a ICW technical steering committee. I hope that a non-partisan, qualified Chief Statistician is named and resourced to continue steering the federal statistical system, and that departments and agencies can retain qualified Statistical Officials to continue meeting as ICSP. There have been stunning setbacks at some agencies in 2025, but all is not lost. Career staff inside agencies continue to do their work with integrity. Linkages across government agencies currently occur and must continue for administrative and statistical purposes. The upheavals of 2025 demonstrate that radical change to government structures is not impossible. Instead of having changes imposed, the statistical community and data users should advocate for an independent, transparent, and sustainable statistical system that produces credible and useful measures for both policymakers and the public. 7. Conclusion The ICW vision remains critical, but achieving it requires rethinking assumptions about data access, linkages, privacy, and ultimately governance of ICW planning efforts. From where we are now, technical innovations, institutional reform, and stable leadership are needed to move forward. A redesigned U.S. statistical system—efficient, transparent, and well-supported—can deliver on the promise of integrated measures of income, consumption, and wealth. Such a system will strengthen policymaking, economic understanding, and hopefully begin to restore public trust in official statistics. Notes 1 National Academies of Sciences, Engineering and Medicine. 2024. Creating an Integrated System of Data and Statistics on Household Income, Consumption, and Wealth: Time to Build. Washington, DC: National Academies Press. 2 Office of Management and Budget, Executive Office of the President. 2025. Budget FY 2026 - Technical Supplement to the 2026 Budget: Appendix, Budget of the United States Government, Fiscal Year 2026. 3 IRS’ Case of Missing Children. December 11, 1989. LA Times. 4 Vaughan, Martin. Americans Filed 15 Million More Tax Returns in 2008. November 13, 2008. Wall Street Journal. 5 Statistics Canada. 2012. Final Report on 2016 Census Options: Proposed Content Determination Framework and Methodology Options. 6 Gindelsky, Marina. December 10, 2024. The Distribution of National Accounts. CNSTAT Fall Seminar. 7 Bee, Adam, Joshua Mitchell, Nikolas Mittag, Jonathan Rothbaum, Carl Sanders, Lawrence Schmidt, and Matthew Unrath. 2023. National Experimental Wellbeing Statistics Version 1. SEHSD Working Paper Number 2023-02 CES Working Paper Number 23-04. 8 Garner, Thesia, Robert S. Martin, Brett Matsumoto, and Scott Curtin. 2025. Distribution of U.S. Personal Consumption Expenditures Using Consumer Expenditure Surveys Data: Methods and Supplementary Results. Consumer Expenditure Surveys Program Report Series.