Matthias Schmid

Hans Schneeweiss

The Effect of Microaggregation by Individual Ranking on the Estimation of Moments

Keywords: consistent estimation, disclosure control, individual ranking, microaggregation, general moments JEL classification: C10, C12, C13

Microaggregation by individual ranking (IR) is an important technique for masking confidential econometric data. While being a successful method for controlling the disclosure risk of observations, IR also affects the results of statistical analyses. We conduct a theoretical analysis on the estimation of arbitrary moments from a data set that has been anonymized by means of the IR method. We show that classical moment estimators remain both consistent and asymptotically normal under weak assumptions. This theory provides the justification for applying standard statistical estimation techniques to the anonymized data without having to correct for a possible bias caused by anonymization.

Introduction

Confidential econometric data that have been collected by a statistical office are usually anonymized before publication. Anonymization is accomplished by making use of statistical disclosure control techniques. These techniques result in a reduction of the information content of the data and thus in a low re-identification risk of the observations in the published data set. As a consequence, data users (e.g., econometricians employed by universities or research institutes) have to rely on the quality of the results obtained from the masked data. A drawback of disclosure control techniques is that the reduction of the information content often leads to an efficiency loss and/or to biased statistical analysis [START_REF] Willenborg | Elements of Statistical Disclosure Control[END_REF], [START_REF] Doyle | Confidentiality, Disclosure, and Data Access[END_REF], [START_REF] Domingo-Ferrer | Privacy in Statistical Databases[END_REF], [START_REF] Ronning | Handbuch zur Anonymisierung wirtschaftsstatistischer Mikrodaten[END_REF], [START_REF] Aggarwal | Privacy-Preserving Data Mining: Models and Algorithms[END_REF]). Due to confidentiality requirements, a certain amount of efficiency loss cannot be avoided. However, if the efficiency loss is not too large, econometricians will still benefit from the published data. In order to control the efficiency loss arising from the anonymization of data sets, the effect of statistical disclosure control techniques on statistical analysis has to be carefully examined.

In this paper the focus is on the effect of microaggregation by individual ranking (IR) on the estimation of general moments and, by implication, on the least squares (LS) estimation of a linear model in transformed variables. IR, which has been popularized by the Statistical Office of the European Communities (Eurostat), is an important statistical disclosure control technique 1 Corresponding author. Email: matthias.schmid@imbe.imed.uni-erlangen.de, Tel.: +49 9131 85 22706, Fax: +49 9131 85 25740 for continuous microdata (see [START_REF] Defays | Masking microdata using microaggregation[END_REF]). The idea of IR is to anonymize each continuous variable in a data set one after another by forming small groups (usually of size 3 or 5) of "similar" data values and by replacing the original data values with the respective group means. It is thus hoped that the values of (potentially sensitive) outliers at the tails of a distribution are masked while the multivariate distribution of the data is approximately preserved. A drawback of IR is that the technique seems to result in a relatively high identification risk of individual observations [START_REF] Domingo-Ferrer | A quantitative comparison of disclosure control methods for microdata[END_REF], Domingo-Ferrer et al. (2002), [START_REF] Winkler | Single-ranking micro-aggregation and reidentification[END_REF]). For this reason, IR has often been used in combination with other disclosure control techniques, especially with techniques designed for masking discrete data. In the United States, for example, IR has been applied to anonymize various versions of the Individual Income Tax Return Public Use File [START_REF] Strudler | Protection of taxpayer confidentiality with respect to the tax model[END_REF], see also http://www.nber.org/ ~taxsim/gdb/). Similarly, according to a survey conducted by the United Nations Economic Commission for Europe (UNECE Secretariat (2001)), IR has been used by several European statistical offices to mask officially collected data before publication. Another review stating that IR is used by European statistical offices was conducted by [START_REF] Felsö | Disclosure limitation methods in use: Results of a survey[END_REF]. In a recent publication on disclosure control, Eurostat considered IR to be a "perfectly acceptable strategy if a slight modification of the data is deemed sufficient" for avoiding disclosure of respondents (Hundepool et al. (2009), p. 115). Similarly, the members of a major German research project recommended to anonymize business data by using a combination of IR and disclosure techniques for discrete variables [START_REF] Ronning | Handbuch zur Anonymisierung wirtschaftsstatistischer Mikrodaten[END_REF][START_REF] Rosemann | Anonymising business micro data -results of a German project[END_REF]). This strategy has been adopted by the German statistical offices [START_REF] Rosemann | Anonymising business micro data -results of a German project[END_REF]).

In two previous papers [START_REF] Schmid | Estimation of a linear model under microaggregation by individual ranking[END_REF], [START_REF] Schmid | Estimation of a linear model in transformed variables under microaggregation by individual ranking[END_REF]) we have analyzed the effect of IR on the estimation of linear models. In [START_REF] Schmid | Estimation of a linear model under microaggregation by individual ranking[END_REF] it was shown analytically that a linear model can be consistently estimated from the microaggregated data by standard LS estimation techniques.

In addition, if the continuous variables in a data set are assumed to follow a mixed normal distribution each, the efficiency loss due to IR is asymptotically zero. In [START_REF] Schmid | Estimation of a linear model in transformed variables under microaggregation by individual ranking[END_REF] we have extended this theory by considering linear models in transformed variables where nonlinear variable transformations are applied to the data after microaggregation. We have shown that even in this case the LS estimators of a linear model remain consistent under mild regularity assumptions.

It should be pointed out that the consistency results derived for transformed data [START_REF] Schmid | Estimation of a linear model in transformed variables under microaggregation by individual ranking[END_REF]) do not automatically follow from the results for untransformed data [START_REF] Schmid | Estimation of a linear model under microaggregation by individual ranking[END_REF]). This is because nonlinear transformations of microaggregated data introduce an additional (finite sample) bias in the LS estimators. For instance, the empirical mean of three logarithmized data values is usually different from the logarithmized mean of the three values.

The purpose of this paper is to provide a generalization of the theory presented in [START_REF] Schmid | Estimation of a linear model under microaggregation by individual ranking[END_REF] and [START_REF] Schmid | Estimation of a linear model in transformed variables under microaggregation by individual ranking[END_REF] to the estimation of arbitrary moments based on transformed and untransformed microaggregated data. The variables involved need not be continuous variables as in [START_REF] Schmid | Estimation of a linear model in transformed variables under microaggregation by individual ranking[END_REF], so the consistency proof is adapted to this more general case. In addition, arbitrary multivariate moments are considered and not only product moments as in [START_REF] Schmid | Estimation of a linear model in transformed variables under microaggregation by individual ranking[END_REF]. We will not only prove the consistency of the empirical moments computed from microaggre-

A C C E P T E D M A N U S C R I P T

ACCEPTED MANUSCRIPT

gated data but will also specify conditions and regularity assumptions under which the moments are asymptotically normal. Arbitrary moments include first, second, and product moments of the transformed and untransformed data as special cases. Thus, the consistency results for linear models presented in [START_REF] Schmid | Estimation of a linear model under microaggregation by individual ranking[END_REF] and [START_REF] Schmid | Estimation of a linear model in transformed variables under microaggregation by individual ranking[END_REF] are confirmed. Moreover, since the consistent estimation of arbitrary moments from the microaggregated data is guaranteed, any method-of-moments estimator is in turn consistent if computed from the microaggregated data. It should be noted that these results (obtained for the IR method) are fundamentally different from previous results obtained for other microaggregation techniques, such as multivariate microaggregation with a sorting variable [START_REF] Mateo-Sanz | A comparative study of microag-gregation methods[END_REF], [START_REF] Domingo-Ferrer | A quantitative comparison of disclosure control methods for microdata[END_REF]). In the latter case, moment estimators have been shown to be asymptotically biased, see [START_REF] Schmid | Estimation of a linear regression under microaggregation with the response variable as a sorting variable[END_REF]. Other approaches to multivariate microaggregation [START_REF] Laszlo | Minimum spanning tree partitioning algorithm for microaggregation[END_REF], [START_REF] Domingo-Ferrer | Efficient multivariate data-oriented microaggregation[END_REF], [START_REF] Martinez-Balleste | A genetic approach to multivariate microaggregation for database privacy[END_REF], [START_REF] Domingo-Ferrer | A polynomial-time approximation to optimal multivariate microaggregation[END_REF] have not yet been analyzed analytically with respect to their impact on the analytic potential of microdata sets.

The paper is organized as follows: In Section 2 we give an example of the IR method and illustrate the problems arising from nonlinear transformations of the microaggregated data. In Section 3 the consistency of the empirical moments computed from transformed micraggregated data is shown. Section 4 deals with the asymptotic normality of these estimators. Section 5 contains a simulation study on the theoretical results derived in Sections 3 and 4, as well as the econometric analysis of an officially collected example data set. A summary of the results presented in this paper is given in Section 6. Proofs of theorems are given in the Appendix.

A C C E P T E D M A N U S C R I P T

ACCEPTED MANUSCRIPT 2 Microaggregation by individual ranking

Microaggregation by individual ranking works as follows: First, the data set is sorted by the first continuous variable, and a fixed group size K is chosen for this variable. Next, groups of K consecutive observations are formed.

The values of the variable in each group are replaced by their corresponding group means, while the values of the other variables in the data set are left unchanged. Then the same procedure is repeated for the second continuous variable, and so on. If the number of observations n is not a multiple of K, it is common practice to alter the procedure such that the groups around the medians contain K + mod (n/K) adjacent data values (see Domingo-Ferrer et al. (2002)). It is generally considered necessary to form groups of at least K = 3 observations, as data attackers can easily identify an observation in a group of less than 3 observations if they have sufficient background knowledge on only one of the observations. In practice, it is common to form groups of sizes 3 or 5. Note that the group size may differ for different variables and can also be equal to 1, meaning that this variable has not been microaggregated.

If there are discrete variables in the data set, they are left unchanged during the IR procedure. We assume that all discrete variables have either been left unchanged or have been masked by so-called non-perturbative disclosure control techniques, so that the multivariate distribution of these variables is unbiased.

Non-perturbative disclosure control techniques, which include subsampling of observations and re-coding of data values, are widely used in practice. For an overview we refer to [START_REF] Willenborg | Elements of Statistical Disclosure Control[END_REF] and [START_REF] Ronning | Handbuch zur Anonymisierung wirtschaftsstatistischer Mikrodaten[END_REF].

As an example of IR we consider a data set consisting of two vectors x and y, containing the values of a discrete binary variable. Assume that the original data set is given by x 2 4 7 0 9 5 1 8 3 y 4 2 0 9 1 5 6 11 10

z 1 0 1 0 1 1 1 1 1 .
The first step of IR results in the sorted data set x 0 1 2 3 4 5 7 8 9 y 9 6 4 10 2 5 0 11 1 z 0 1 1 1 0 1 1 1 1 , where the rows of the original data set have been ordered according to the values of x. In the second step of IR, with K chosen to be 3, the values of x are microaggregated:

x 1 1 1 4 4 4 8 8 8 y 9 6 4 10 2 5 0 11 1 z 0 1 1 1 0 1 1 1 1 . The third step of IR results in the sorted data set x 8 8 4 1 4 1 1 4 8 y 0 1 2 4 5 6 9 10 11 z 1 1 0 1 1 1 0 1 1 , where the rows have been ordered according to the values of y. Finally, in the fourth step of IR, again with K chosen to be 3, the values of y are microaggregated:

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

x 8 8 4 1 4 1 1 4 8 ỹ 1 1 1 5 5 5 10 10 10 z 1 1 0 1 1 1 0 1 1 . Now suppose that ỹ is additionally transformed by means of a quadratic transformation. Then ỹ2 = (1,1,1,25,25,25,100,100,100) .

Obviously, taking the squares of the microaggregated values of y results in a different data set than when the squared values of y are microaggregated. In the latter case, one would have obtained 67, 1.67, 1.67, 25.67, 25.67, 25.67, 100.67, 100.67, 100.67) . Now consider the estimation of a theoretical moment, i.e., the expectation of an arbitrary one-dimensional function of the random variables (X, Y, Z) from the microaggregated data. Since the original data have been altered by IR, the consistent estimation of the theoretical moment by its corresponding ordinary

y 2 = (1.

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

empirical moment is not guaranteed any more. In the next sections we will address this problem.

Consistent estimation of moments

Let X = (X (1) , . . . , X (p) ) be a p-dimensional random vector and let x(p) i ), i = 1, . . . , n. The group size for the aggregation of X (k) is denoted by K k . For simplicity we always assume n to be a multiple of K k (this assumption does not affect the asymptotic results derived in the following).

x i = (x (1) i , . . . , x (p) i ), i = 1, . . . ,
We want to prove that the usual consistent estimator of the moments of the distribution of X remains consistent if we replace the original data by their microaggregated data values.

Let us consider general moments: Suppose that the expectation E[h(X)] for some measurable real-valued function h exists. We know that, given an i.i.d.

sample (x 1 , . . . , x n ), E[h(X)] can be consistently estimated by the empirical

mean 1 n n i=1 h(x i ). The following sufficient conditions guarantee that E[h(X)]
can be consistently estimated by the empirical mean

1 n n i=1 h(x i ) constructed
from the individually microaggregated data xi ,, i = 1, . . . , n:

H1: h is defined on an open p-dimensional rectangle D = D 1 × • • • × D p , where D k is a finite or infinite open interval on the real line, k = 1, . . . , p. The support of X is contained in D.
H2: h is Lipschitz continuous on every finite closed p-dimensional subrectangle

B = B 1 × • • • × B p ⊂ D, where each B k , k = 1, . . . , p, is a finite closed
interval on the real line (i.e., there exists a positive bound H ′ depending only on B such that, for any two points x 1 ∈ B and

x 2 ∈ B, |h(x 1 )-h(x 2 )| ≤ H ′ d(x 1 , x 2 )
, where d(x 1 , x 2 ) is the Euclidean distance between x 1 and x 2 ).

H3: There exist non-negative real-valued functions h k (x (k) ) defined on D k , k = 1, . . . p, which are Lipschitz continuous on every finite closed interval

B k ⊂ D k , such that |h(x)| ≤ p k=1 h k (x (k)
) for all x = (x (1) , .., x (p) ) ∈ D.

H4:

E[h 2 k (X (k) )] < ∞, k = 1, . . . p. H5: h k is monotone on each side of C k , where C k ⊂ D k is a fixed finite closed interval and C k its complement in D k .
Remark 1: The Lipschitz condition in H2 and H3 can be replaced with the more familiar condition that h and h k are continuously differentiable on their domains. Of course, the Lipschitz condition is weaker and therefore to be preferred. E.g., the function h(x) = |x| is Lipschitz but not differentiable in its domain.

Theorem 1 Let X be a p-dimensional random vector and (x 1 , . . . , x n ) an i.i.d. sample from the distribution of X. Let (x 1 , . . . , xn ) be the corresponding microaggregated sample with fixed aggregation group sizes K k , k = 1, . . . , p, assuming (w.l.o.g.) n to be a multiple of K k . Let h(x) satisfy the conditions H1 to H5. Then a. s.

lim n→∞ 1 n n i=1 h(x i ) = E[h(X)] .
In the univariate case (p = 1), condition H4 can be replaced with the weaker condition

H4 ′ : E[h k (X (k) )] < ∞, k = 1, . . . p.
PROOF. See Appendix.

Example 1: For the one-dimensional case (p = 1), Theorem 1 applies to ordi-

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT
nary moments of X and moments of transformed variables h(X), such as |X|, sin(X), log(X), or X λ , λ ∈ R + , where in the last two cases D = (0, ∞). These moments can be consistently estimated from the microaggregated sample via the empirical moments 1 n n i=1 h(x i ). An example for p = 2 is the product

moment E[h 1 (X (1) )h 2 (X (2) )] of two transformed variables with h k Lipschitz on each B k , h k (x (k)
) monotone on each side of some Ck , and

E[h 4 k (X (k) )] < ∞, k = 1, 2. Indeed, as |h 1 (X (1) )h 2 (X (2) )| ≤ h 2 1 (X (1) ) + h 2 2 (X (2) ), condition H3 is satisfied.
Corollary 1 For two variables X (1) and X (2) (p = 2), the conclusion of Theorem 1 also holds true if the sum 2 k=1 h k (x (k) ) in condition H3 is replaced with the product:

h 1 (x (1) )h 2 (x (2)
) of two corresponding functions.

PROOF. See Appendix.

Example 2: Again the product moment is an example, but now we get the previous result with the weaker condition that both

E[h 2 k (X (k) )], k = 1, 2, exist, while E[h 4 k (X (k) )
] need not exist, see also [START_REF] Schmid | Estimation of a linear model in transformed variables under microaggregation by individual ranking[END_REF].

Theorem 1 and Corollary 1 imply that, under mild regularity conditions, a linear regression model in transformed variables can be consistently estimated with microaggregated data.

Asymptotics

Theorem 1 states that we can consistently estimate any moment E[h(X)]

from the transformed microaggregated data in the same way as we would estimate E[h(X)] from the non-microaggregated data. We now give conditions under which the estimator constructed from the microaggregated data

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT
is asymptotically as efficient as the corresponding estimator constructed from the non-aggregated data. It is possible to prove even more: The two estimators are asymptotically equivalent under certain conditions, in the sense that √ n(

1 n n i=1 h(x i ) -1 n n i=1 h(x i )) tends to zero in probability with n → ∞.
There are two sets of conditions that we need, one concerning the transformation function h, the other one concerning the distribution of X. The conditions on h are stronger than the corresponding conditions for Theorem 1.

h k (x (k) ) =                    h lk (x (k) ) for d lk < x (k) < c lk C for c lk ≤ x (k) ≤ c uk h uk (x (k) ) for c uk < x (k) < d uk ,
where C is a positive constant and

h lk (x (k) ) =            a lk (-x (k) ) m lk if d lk = -∞ a lk (x (k) -d lk ) -m lk if d lk > -∞ , h uk (x (k) ) =            a uk (x (k) ) m uk if d uk = ∞ a uk (d uk -x (k) ) -m uk if d uk < ∞
with some positive constants a lk , a uk , m lk , and m uk , such that

|h ′ r (x)| ≤ p k=1 h k (x (k) ), r = 1, . . . , p.
Remark 2: The bounding functions h k (x (k) ) of Condition H3 * increase like power functions when x (k) approaches the boundaries of D k . They are monotone near these boundaries, while they are constant in the middle region C k .

F (Condition on the distribution of X):

Let F k be the distribution function of X (k) . Then, with m lk and m uk from Assumption H,

lim n→∞ 1 -F k -n 1 4(m lk +1) n = 1 if d lk = -∞ , lim n→∞ 1 -F k d lk + n -1 4m lk n = 1 if d lk > -∞ , lim n→∞ F k n 1 4(m uk +1) n = 1 if d uk = ∞ , lim n→∞ F k d uk -n -1 4m uk n = 1 if d uk < ∞ .
Remark 3: While the conditions on h k bound the growth of h ′ (x) when x (k) approaches the boundaries of D k , the conditions on the distribution of X describe how fast the distribution function F k (x (k) ) tends to 0 or 1 when

x (k) approaches the boundaries of D k . The stronger h k (x (k) ) grows at the

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT boundaries of D k (i.e.
, the larger the numbers m lk and m uk are), the faster k) ) has to go to its limits 0 or 1.

F k (x (
Theorem 2 Suppose an i.i.d. sample x 1 , . . . , x n of a random vector X has been microaggregated. If the transformation function h and the distribution functions of X (k) satisfy conditions H and F , respectively, then

plim n→∞ 1 √ n n i=1 h(x i ) - n i=1 h(x i ) = 0 . (1)
PROOF. See Appendix.

Assuming that the estimator )] is asymptotically normal with asymptotic variance σ 2 h /n, the asymptotic equivalence of 1 n n i=1 h(x i ) and

1 n n i=1 h(x i ) of E[h(X
1 n n i=1 h(x i ) implies that 1 n n i=1 h(x i
) is also asymptotically normal with the same asymptotic variance:

√ n 1 n n i=1 h(x i ) -E[h(X)] n→∞ -→ N(0, σ 2 h ) . (2)
Thus the estimator with microaggregated data is (asymptotically) just as efficient as the estimator with the original data.

Example 3: Let p = 1 and (suppressing the index k = 1) let X ∼ N(µ, σ 2 ) and h(x) = x r , r ∈ Z + . The estimator 1 n n i=1 h(x i ) then estimates the r-th moment of X. With microaggregated data the estimator is

1 n n i=1 h(x i ). We
show that the conditions of Theorems 1 and 2 are satisfied. First note that D = (-∞, ∞). Obviously, h(x) is continuously differentiable and |h(x)| is monotone for x > 0 as well as for x < 0. Also E(X r ) exists. By Theorem 1,

1 n n i=1 xr i is a consistent estimator of E(X r ).
As to the conditions of Theorem 2, first note that obviously H is satisfied with

m u = m l = r -1.
F is also satisfied because (assuming w.l.o.g. µ = 0 and

σ 2 = 1) lim n→∞ Φ(n 1 4r ) n = 1 ,
see [START_REF] Schmid | Estimation of a linear regression under microaggregation with the response variable as a sorting variable[END_REF]. Similarly,

1 -Φ(-n 1 4r ) n = Φ(n 1 4r ) n n→∞ -→ 1 .
Thus, by Theorem 2,

1 n n i=1
xr i is an asymptotically normal estimator of E(X r )

with the same asymptotic variance as

1 n n i=1 x r i .
Example 4: Let X be lognormally distributed, i.e., log(X) ∼ N(µ, σ 2 ) and let h(x) = (log(X)) r , r ∈ Z + . (Again p = 1 and the index k = 1 is suppressed).

The estimator 1 n n i=1 h(x i ) then estimates the r-th moment of log(X). We

show that the conditions of Theorems 1 and 2 are satisfied.

First note that the domain of log(X) is D = (0, ∞) and the support of X coincides with D. Obviously, h is continuously differentiable. In addition, |h(x)| = | log(x)| r is monotone for 0 < x < 1 and for x > 1. Also, E[h(X)]

exists. Thus Theorem 1 can be applied showing that

1 n n i=1 (log(x i )) r is a consistent estimator of E[(log(X)) r ].
To verify the conditions for Theorem 2, first note that d l = 0 and d u = ∞. As

|h ′ (x)| = r| log(x)| r-1 x -1 , |h ′ (x)| ≤ max x≥1 |h ′ (x)| = r(r -1) r-1 e 1-r =: a for x ≥ 1 (3) and |h ′ (x)| < rx -r for 0 < x < 1 (4) because | log(x)| < 1
x for 0 < x < 1. Thus, condition H is satisfied with m u = 0 and m l = r. Without loss of generality we may assume X to be

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

standard log-normally distributed, i.e., log(X) ∼ N(0, 1). Then (with m u = 0) n . Then, since

F n 1 4(mu +1) = Φ 1 4 log(n) =: Φ(b n ) . Now, Φ(b) > 1 -1 √ 2π 1 b e -
a n = 4n √ 2π log(n) e -1 32 log 2 (n) → 0 for n → ∞, we have (1 -an n ) n → e 0 = 1, and hence [Φ(b n )] n → 1. Thus F n 1 4(mu +1) n → 1
for n → ∞. Similarly (with d l = 0 and m l = r)

1 -F d l + n -1 4m l n = 1 -F n -1 4r n = 1 -Φ -1 4r log(n) n = Φ 1 4r log(n) n → 1 .
This shows that condition F is satisfied as well. Thus Theorem 2 can be applied showing that 1 n n i=1 (log(x i )) r is an asymptotically normal estimator of E[(log(X)) r ].

Simulations and application example

We start with a simulation study on the quadratic regression

Y = 5 • X 2 + ǫ , (5)
where X and ǫ are independent and standard normally distributed each. The slope parameter β = 5 can be expressed as a continuously differentiable func-

tion of the moments E[Y • X 2 ] and E[(X 2 ) 2 ]
. Now suppose that Y and X have both been microaggregated with group size K = 3, and that the quadratic

A C C E P T E D M A N U S C R I P T

ACCEPTED MANUSCRIPT

transformation has to be applied to the data values of X after microaggregation. Then Theorem 1 guarantees the consistent estimation of E[Y • X 2 ] and E[(X 2 ) 2 ] from the data (see Examples 1 and 2), and thus also the consistent least squares estimation of β. Moreover, due to Theorem 2, application of the delta method guarantees the asymptotic normality and efficiency of the least squares estimator of β computed from the microaggregated data. It is straightforward to extend these results to the case of a multiple polynomial regression. Table 1 shows the estimation results for n = 300 and 100 simulation runs. The similarities between the least squares estimator based on the non-aggregated data and the least squares estimator based on the transformed microaggregated data are obvious.

Our next example is the method-of-moments estimator of the shape and scale parameters of a Gamma distributed random variable X. 2, where the estimation results of a simulation study with 100 simulation runs are shown, confirms this result (n = 300, K = 3, α = 0.5, β = 2).

Our third example concerns the maximum likelihood estimation of the scale

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

parameter c of a Levy distribution with density function

f (x) = c 2π e -c/(2x) x 3/2 . (6)
The score function of a Levy distributed i.i.d. data sample x 1 , . . . , x n is given by

∂l ∂c (x 1 , . . . , x n ) = n 2c - n i=1 1 2x i . ( 7
)
As the maximum likelihood estimator ĉ :

= n i=1 (1/x i )/n -1 is a consistent estimator of c, n i=1 (1/x i )/n
-1 is also consistent (which is guaranteed by Theorem 1 and the monotonicity of h(x) = 1/x). Table 3, where the estimation results of a simulation study with 100 simulation runs are shown, confirms this result (n = 300, K = 3, c = 2).

Our final example is an analysis based on the data of the 2004 cost structure survey of enterprises of the mining and manufacturing industry in Germany (KSE). This survey is carried out regularly by the German Federal Statistical

Office. As the data obtained from this survey contain comprehensive information on the German industry, they form an important basis for the national accounts of Germany. Also, they are a typical example of an officially collected data set that has to be anonymized before dissemination. The 2004 KSE data have been obtained from n = 16 099 companies with 20 or more employees.

Following the approach of [START_REF] Fritsch | Die Heterogenität der technischen Effizienz innerhalb von Wirtschaftszweigen -Auswertungen auf Grundlage der Kostenstrukturstatistik des Statistischen Bundesamtes[END_REF] and [START_REF] Ronning | Handbuch zur Anonymisierung wirtschaftsstatistischer Mikrodaten[END_REF], we estimate a linear model of the form

log(Y ) = γ 0 + 5 j=1 β j log(X ( j ) ) + ǫ , ( 8
)
where Y is an adjusted gross output of the companies and the regressors 5) are various cost factors. Model (8) corresponds to a logarithmized Cobb-Douglas production function whose production elasticities are

X (1) , . . . , X (

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

equal to the coefficients β 1 , . . . , β 5 . As the least squares estimator of Model ( 8) from a microaggregated data set with variables Y, X (1) , . . . , X (5) is based on the first and second moments of log(Y ), log(X (1) ), . . . , log(X (5) ), Theorem 1 applies (see Example 1), assuming that the regressor variables are (at least approximately) lognormally distributed.

Tables 4 and5 show the estimation results obtained from the transformed original data and from the transformed microaggregated data (IR with group size K = 3). As expected, we see that IR has virtually no effect on the coefficient estimates of Model ( 8) and their estimated standard deviations.

Summary and conclusion

Microaggregation by individual ranking (IR) is a disclosure control technique which is generally considered to have a relatively small impact on the utility of an anonymized data set. In this paper we have shown analytically that IR has indeed favorable properties with respect to the estimation of statistical models: Any arbitrary moment which is defined as the expectation of a function h of a set of random variables can be consistently estimated from the microaggregated data by using the standard empirical moment estimators. Moreover, we did not assume the variables under consideration to be continuous. Thus, mixed moments between a microaggregated continuous and a non-microaggregated discrete variable can be estimated, as well as moments purely based on microaggregated continuous variables.

A further important result is the proof of asymptotic normality of the moment estimators based on the microaggregated data. This follows from the fact that the moment estimators are asymptotically equivalent to the corresponding belong to the same microaggregation group for X (k) . We shall prove that

E[h k (X (k) )I Bk (X (k) )] < ǫ , (9)
lim n→∞ 1 n n i=1 h(x i ) - 1 n n i=1 h(x i ) = 0 a. s. (11) Now 1 n n i=1 h(x i ) - 1 n n i=1 h(x i ) ≤ S 1 + S 2 + S 3 ,
where

S 1 := 1 n i:G k (i)⊂B k k=1,...,p |h(x i ) -h(x i )| , S 2 := 1 n p k=1 i:G k (i)⊂ Bk |h(x i ) -h(x i )| =: p k=1 S 2k , S 3 := 1 n p k=1 i:G k (i) ⊂B k G k (i) ⊂ Bk |h(x i ) -h(x i )| =: p k=1 S 3k .
We start with S 1 . Because x i ∈ B as well as xi ∈ B for all i such that G k (i) ⊂ B k for k = 1, . . . , p, we have, by Assumption H2, and some to the right of B k , but such a group can be treated in a similar way as the other ones). Let G k denote the set of indices that belong to these two groups (G k may be empty). There are at most 2K k indices in G k . Now

S 1 ≤ 1 n H ′ i:G k (i)⊂B k k=1,...,p p k=1 x (k) i - x(k) i ≤ 1 n H ′ p k=1 i:G k (i)⊂B k x (k) i - x(k) i ≤ 1 n H ′ p k=1 i:G k (i)⊂B k ||G k (i)|| ≤ 1 n H ′ p k=1 K k ||B k || ,
S 3k = 1 n i∈G k |h(x i ) -h(x i )| ≤ 1 n i∈G k p l=1 h l (x (l) i ) + h l (x (l) i )
by Assumption H3. As to the term h l (x (l)

i ), we have

h l (x (l) i ) ≤ H l + n j=1 h l (x (l) j ) I Bl (x (l) j ) ,
where H l = max x (l) ∈B l h l (x (l) ). This is because either x(l) i ∈ B l and then h(x

(l) i ) ≤ H l or h l (x (l)
i ) > H l and then x(l) i ∈ Bl , and, because of the monotonicity property of h l , there is at least one x

(l) j ∈ Bl such that h l (x (l) i ) ≤ h l (x (l) j ).
Consequently, h l (x

(l) i ) ≤ n j=1 h l (x (l) j ) I Bl (x (l) j ).
As there are at most 2K k indices in G k , we have

1 n i∈G k h l (x (l) i ) ≤ 2K k n H l + 2K k n n j=1 h l (x (l) j ) I Bl (x (l) j ) .
The first term on the right-hand side converges to zero and the last term con-

lim n→∞ 1 n h(x i ) = E[h(X)] a.
s. (Note that we did not use Assumption H4 in the proof for the univariate case, but rather the weaker Assumption H4 ′ ). Now let us continue with the multivariate case. The inequality in (14) implies

S 2k ≤ 1 n p l=1 i∈ Bk h l (x (l) i ) + h l (x (l) i ) = p l=1 1 n n i=1 h l (x (l) i )I Bk (x (k) i ) + 1 n n i=1 h l (x (l) i )I Bk (x (k) i ) . ( 16
)
Considering the first sum in ( 16), we have by the Cauchy-Schwartz inequality

that 1 n n i=1 h l (x (l) i )I Bk (x (k) i ) ≤ 1 n n i=1 h 2 l (x (l) i ) 1 n n i=1 I Bk (x (k) i ) .
From what we have just proved for the univariate case (replacing h with h 2 l ), the first square root converges to E[h 2 l (X (l) )]. The second square root converges to E[I Bk (X (l) )], which is less than ǫ by Assumption (10). As the same can be said of the second sum in ( 16), it follows that S 2k < C 3 ǫ and hence S 2 < C 4 ǫ a. s. for n sufficiently large.

Summing up, we have for sufficiently large n that

1 n n i=1 h(x i ) - 1 n n i=1 h(x i ) < C ǫ a. s. ( 17
)
with some constant C. This proves (11).

Proof of Corollary 1:

We use the notation of the proof of Theorem 1. The data vector x i is now

equal to x i = (x (1) i , x (2)
i ). The partial sum S 1 is treated as before, so we only need to consider S 2 and S 3 . Let S 2 = S 21 + S 22 as in the proof of Theorem 1.

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

For S 21 we have that

S 21 = 1 n i:G 1 (i)⊂ B1 |h(x i ) -h(x i )| ≤ 1 n i:G 1 (i)⊂ B1 |h(x i )| + 1 n i:G 1 (i)⊂ B1 |h(x i )| .
Consider the first sum. By the modified assumption H 3 and by the Cauchy-Schwartz inequality,

1 n i:G 1 (i)⊂ B1 |h(x i )| ≤ 1 n i:G 1 (i)⊂ B1 h 1 (x (1) i )h 2 (x (2) i ) ≤ 1 n i:G 1 (i)⊂ B1 h 2 1 (x (1) i ) 1 n i:G 1 (i)⊂ B1 h 2 2 (x (2) i ) ≤ K 1 n n i=1 h 2 1 (x (1) i )I B1 (x (1) i ) 1 n n i=1 h 2 2 (x (2)
i ) .

The last inequality follows from similar arguments that led to ( 15), but with h 2 1 in place of h. The first radicand converges to

K 1 E[h 2 1 (X (1) )I B1 (X (1)
)], which is less than K 1 ǫ by assumption, and the second one to E[h 2 2 (X (2) )] by Theorem 1.

Thus

1 n i:G 1 (i)⊂ B1 |h(x i )| < C 5 ǫ a. s.
for sufficiently large n. The other parts of S 2 can be treated in the same way, yielding S 2 < C 6 ǫ a. s. for sufficiently large n. In a similar way we can show that S 3 < C 7 ǫ and thus S ≤ C 8 ǫ a. s.

for sufficiently large n. This completes the proof.

Proof of Theorem 2:

We need some preliminary definitions. Let Let A n be the event that 1 √ n | n i=1 h(x i ) -n i=1 h(x i )| > ǫ and let B n be the event that x i ∈ B for all i = 1, . . . , n (and hence also xi ∈ B for all i). We have to prove that lim n→∞ P(A n ) = 0 for all ǫ > 0. Now P(A n ) ≤ P(A n ∩ B n ) + P( Bn ) .

B k = B k (n) = [b lk (n), b uk (n)]
b lk =            -n 1 4(m lk +1) if d lk = -∞ d lk + n -1 4m lk if d lk > -∞ , (18) b uk =            n 1 4(m uk +1) if d uk = ∞ d uk -n -1 4m uk if d uk < ∞ .
We want to prove that P(A n ∩ B n ) → 0 as well as P( Bn ) → 0. First consider the event A n ∩ B n . Under this event (using a Taylor series approximation with

x * i = tx i + (1t)x i , 0 < t < 1, and using (20)), Simulation study on the shape and scale parameter estimation of a gamma distribution -summary statistics of the 100 method-of-moments estimates (α = 0.5, β = 2). 35 3

ǫ < 1 √ n n i=1 |h(x i ) -h(x i )| ≤ 1 √ n n i=1 p r=1 |h ′ r (x * i )||x (r) i -x (
Simulation study on maximum likelihood estimation of the scale parameter c of a Levy distribution -summary statistics of the 100 maximum likelihood estimates (c = 2). 36 4

Least squares estimates of Model (8) obtained from the 2004 KSE data. The abbreviation "MA" stands for "microaggregation". The coefficient estimates have been rounded to two decimal places, so the results obtained from the non-aggregated data are not exactly the same as the results obtained from the microaggregated data. 37 5

Estimated standard deviations of the least squares estimates of Model (8) obtained from the 2004 KSE data. The abbreviation "MA" stands for "microaggregation". All estimates have been rounded to two decimal places, so the results obtained from the non-aggregated data are not exactly the same as the results obtained from the microaggregated data. 38

Estimates Table 2 Simulation study on the shape and scale parameter estimation of a gamma distribution -summary statistics of the 100 method-of-moments estimates (α = 0.5, β = 2).

σ β 1 σ β 2 σ β 3 σ β 4 σ β 5
non-aggregated data 0.0021 0.0036 0.0015 0.0023 0.0027 IR (log trafo after MA) 0.0021 0.0036 0.0015 0.0023 0.0027 Table 5 Estimated standard deviations of the least squares estimates of Model (8) obtained from the 2004 KSE data. The abbreviation "MA" stands for "microaggregation".

All estimates have been rounded to two decimal places, so the results obtained from the non-aggregated data are not exactly the same as the results obtained from the microaggregated data.

  n, be an i.i.d. sample taken from the distribution of X. The corresponding individually microaggregated data are denoted by xi

H

  (Conditions on the transformation function h): H1 * : Same as H1. As to notation, let D k = (d lk , d uk ), where d lk and/or d uk may be finite or infinite. H2 * : The function h(x) has continuous partial derivatives on D denoted by h ′ k (x) := ∂ ∂x (k) h(x (1) , . . . , x (p) ), k = 1, . . . , p. H3 * : For each k = 1, . . . , p, let C k = [c lk , c uk ] ⊂ D k be a finite closed interval lying in D k , where c uk > 0 (c lk < 0) if d uk = ∞ (d lk = -∞). Suppose there are functions h k (x (k) ), k = 1, . . . , p, of the following form:

1 2 b 2

 2 for any b > 0 and, in particular, for b = b n , seeDurrett (1991), Theorem (1.3). Let a n := n

  Denote the shape parameter by α and the scale parameter by β. It is well known that the method-of-moments estimators computed from an i.i.d. sample x 1 , . . . , x n are α = m 2 1 /(m 2m 2 1 ) and β = (m 2m 2 1 )/m 1 , where m 1 := n i=1 x i /n and m 2 := n i=1 x 2 i /n are the first and second empirical moments of X. Since we have shown in Theorem 1 that the corresponding empirical moments computed from a microaggregated data set x1 , . . . , xn converge a. s. to m 1 and m 2 as n → ∞, estimation of α and β based on the microaggregated data yields asymptotically the same values as estimation based on the original data. Table

A

  C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPTmoment estimators computed from the non-aggregated data. Moment estimators with microaggregated and with the original data are thus equally efficient asymptotically. These results have been derived under suitable regularity conditions concerning the behavior of the transformation function h and of the distribution at the border of the domain of h. The simulation studies and data examples presented in Section 5 show that the asymptotic theory derived in this paper is already applicable when sample sizes are relatively small, i.e., when n ≥ 300.It should finally be pointed out that the favorable properties of the IR method go hand in hand with a relatively weak protection effect of IR, at least if no additional disclosure control procedures have been employed (there is generally a trade-off between analytic potential and protection effect of a disclosure control technique). However, as stated in Section 1, several statistical offices have used IR in combination with other disclosure control techniques to create safe public-use and scientific-use files. In particular, application of IR may be appropriate if the discrete variables in a data set (which serve as the main identifiers for attackers and data snoopers) are suitably anonymized by means of disclosure control techniques for discrete data. An overview of such methods is given in[START_REF] Willenborg | Elements of Statistical Disclosure Control[END_REF]. Also, the protection effect of IR can be enhanced if the group sizes K k are taken sufficiently large. In this context, it is important to note that our asymptotic results do not depend on K k . The consistency and asymptotic normality properties of the moment estimators based on the microaggregated data are not affected by the choice of the group size. Other microaggregation methods, such as distance-based microaggregation techniques (Domingo-Ferrer and Mateo-Sanz (2002), Laszlo and Mukherjee (2005), Domingo-Ferrer et al. (2006)) or microaggregation by

P

  (X (k) ∈ Bk ) < ǫ, k = 1, . . . , p , (10) for some preassigned ǫ > 0, Bk being the complement of B k in D k . This is possible because of Assumption H4. Let B k := {i : x (k) i ∈ B k } and let G k (i) be the set of all indices j such that x

  be closed finite intervals depending on n and B = B 1 ו • •×B p be the corresponding p-dimensional rectangle. (Note that B is not the same as the rectangle B used in the proof of Theorem 1). Let b lk = b lk (n) and b uk = b uk (n) be the following functions depending on whether the boundaries of D are finite or infinite:

  that B k is contained in D k and converges to D k for n → ∞. Let n be large enough so that C k ⊂ B k (n) for all k ∈ {1, . . . , p}. It follows from Assumption H3 * that h k (x k ) ≤ C +h uk (b uk )+h lk (b lk ) for x k ∈ B k , r = 1 . . . , p,(see Remark 2), and thus |h ′ r (x)| ≤ p C + p k=1 {h uk (b uk ) + h lk (b lk )} for x ∈ B .(20)

  uk (b uk ) + h lk (b lk )} p r=1 K r (b urb lr ) .(21) standard deviations of the least squares estimates, multiplied with √ n = √ 300, were 0.792 (original data) and 0.855 (microaggregated data). 34 2

  where ||G k (i)|| is the range of the x belonging to group G k (i) and ||B k || is the length of the interval B k . The last inequality follows because there are K k elements in each G k (i). The last term converges to 0 as n → ∞, soThe sum S 3 is a borderline case: For each k there are at most two aggregation groups G k (i) for which G k (i) ⊂ B k and G k (i) ⊂ Bk . (On rare occasions, there may be only one group such that some x

	(k)
	j
	S 1 < ǫ	(12)
	for sufficiently large n.
	(k) i	in this group lie to the left of B k

  of α Min. 1st Qu. Median Mean 3rd Qu. Max. Min. 1st Qu. Median Mean 3rd Qu. Max.

	Original data	0.372	0.468	0.510 0.514	0.561 0.729
	Microaggregated data 0.394	0.479	0.517 0.520	0.564 0.729
	Estimates of β
	Original data	1.324	1.757	1.972 1.966	2.167 2.676
	Microaggregated data 1.320	1.736	1.945 1.938	2.105 2.622

ACCEPTED MANUSCRIPTboth containing continuous data. In addition, we consider a "dummy" vector z

Acknowledgements:

We thank Nadine Bartke and Mario Walter of the Bavarian State Office for Statistics and Data Processing for their support with the analysis of the 2004 KSE data. We also thank Daniel Rost and two anonymous referees for very helpful discussions and comments on the manuscript.

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

a sorting variable [START_REF] Mateo-Sanz | A comparative study of microag-gregation methods[END_REF], [START_REF] Domingo-Ferrer | A quantitative comparison of disclosure control methods for microdata[END_REF]), are generally considered to be more effective in protecting confidential data than the IR method. However, the analytic potential of data sets that have been masked by means of these methods seems to be limited (though partially retrievable, at least for the case of microaggregation with a sorting variable, see [START_REF] Schmid | Estimation of a linear regression under microaggregation with the response variable as a sorting variable[END_REF]).

While analyzing the protection effect of IR clearly is beyond the scope of this paper, we suggest that in those cases where the application of IR to an econometric data set sufficiently reduces disclosure risk, IR should be applied, since the method guarantees that many standard estimation techniques result in valid econometric findings.

Appendix

Proof of Theorem 1:

, p, and let

)], which is less than 2 K k ǫ by Assumption (9). We have a similar bound for 1 n i∈G k h l (x (l) i ) (just replace K k with 1) and so, with some constant C 1 , S 3k < C 1 ǫ a. s. for sufficiently large n. Hence, with some constant C 2 ,

a. s. for sufficiently large n.

Finally consider S 2 . By Assumption H3,

Let us pause for a moment and let us first finish the proof for the univariate case (p = 1). The result will be used to prove the multivariate case. To simplify the notation, let us suppress the index k = 1. Since G(i) ⊂ B and h(x j ) is monotone on each side of B,

Because each set G(i) has K indices and because

The last term converges to K E[h(X)I B(X )] as n → ∞. By similar arguments, the second sum in ( 14) is bounded by a term that converges to

Hence S 2 is bounded by a term that converges to (K + 1)

which is less than (K + 1) ǫ by Assumption (9). This shows that, for p = 1, S 2 < (K + 1) ǫ a. s. for sufficiently large n. Together with ( 12) and ( 13) it follows that the whole sum S converges to 0 a. s. Thus, in the univariate case,

ACCEPTED MANUSCRIPT

Now, by ( 18) and ( 19),

From ( 18), ( 19), ( 22), and ( 23) it is clear that the product terms that arise from evaluating (21) take the form

with positve real numbers m and m ′ . As all product terms go to zero with n → ∞, (21) also tends to zero with n → ∞. Hence P(A n ∩ B n ) → 0.

Next consider Bn . We have

With b lk and b uk from ( 18) and ( 19) we have, by condition Least squares estimates of Model (8) obtained from the 2004 KSE data. The abbreviation "MA" stands for "microaggregation". The coefficient estimates have been rounded to two decimal places, so the results obtained from the non-aggregated data are not exactly the same as the results obtained from the microaggregated data.

ACCEPTED MANUSCRIPT