  The use of formal privacy to protect the confidentiality of responses in the
2020 Decennial Census of Population and Housing has triggered renewed interest
and debate over how to measure the disclosure risks and societal benefits of
the published data products. Following long-established precedent in economics
and statistics, we argue that any proposal for quantifying disclosure risk
should be based on pre-specified, objective criteria. Such criteria should be
used to compare methodologies to identify those with the most desirable
properties. We illustrate this approach, using simple desiderata, to evaluate
the absolute disclosure risk framework, the counterfactual framework underlying
differential privacy, and prior-to-posterior comparisons. We conclude that
satisfying all the desiderata is impossible, but counterfactual comparisons
satisfy the most while absolute disclosure risk satisfies the fewest.
Furthermore, we explain that many of the criticisms levied against differential
privacy would be levied against any technology that is not equivalent to
direct, unrestricted access to confidential data. Thus, more research is
needed, but in the near-term, the counterfactual approach appears best-suited
for privacy-utility analysis.
