  Formal disclosure avoidance techniques are necessary to ensure that published
data can not be used to identify information about individuals. The addition of
statistical noise to unpublished data can be implemented to achieve
differential privacy, which provides a formal mathematical privacy guarantee.
However, the infusion of noise results in data releases which are less precise
than if no noise had been added, and can lead to some of the individual data
points being nonsensical. Examples of this are estimates of population counts
which are negative, or estimates of the ratio of counts which violate known
constraints. A straightforward way to guarantee that published estimates
satisfy these known constraints is to specify a statistical model and
incorporate a prior on census counts and ratios which properly constrains the
parameter space. We utilize rejection sampling methods for drawing samples from
the posterior distribution and we show that this implementation produces
estimates of population counts and ratios which maintain formal privacy, are
more precise than the original unconstrained noisy measurements, and are
guaranteed to satisfy prior constraints.
