Security of statistical databases

The concept of multidimensional transformation of statistical databases is described. A given set of statistical output may be compatible with more than one statistical database. A transformed database D ' is a database which (1) differs from the original database D in its record content, but (2) produces, within certain limits, the same statistical output as the original database. For a transformable database D there are two options: One may physically transform D into a suitable database D ', or one may release only that output which will not permit the users to decide whether it comes from D or D '. The second way is, of course, the easier one. Basic structural requirements for transformable statistical databases are investigated. The closing section discusses advantages, drawbacks, and open questions.