Editors:Katie Harron, London School of Hygiene and Tropical Medicine, UKHarvey Goldstein, University of Bristol and University College London, UKChris Dibben, University of Edinburgh, UK

• Foreword xiContributors xiii1 Introduction 1Katie Harron, Harvey Goldstein and Chris Dibben1.1 Introduction: data linkage as it exists 11.2 Background and issues 21.3 Data linkage methods 31.3.1 Deterministic linkage 31.3.2 Probabilistic linkage 31.3.3 Data preparation 41.4 Linkage error 51.5 Impact of linkage error on analysis of linked data 61.6 Data linkage: the future 72 Probabilistic linkage 8William E. Winkler2.1 Introduction 82.2 Overview of methods 102.2.1 The Fellegi–Sunter model of record linkage 102.2.2 Learning parameters 132.2.3 Additional methods for matching 202.2.4 An empirical example 222.3 Data preparation 232.3.1 Description of a matching project 242.3.2 Initial file preparation 252.3.3 Name standardisation and parsing 262.3.4 Address standardisation and parsing 272.3.5 Summarising comments on preprocessing 272.4 Advanced methods 282.4.1 Estimating false]match rates without training data 282.4.2 Adjusting analyses for linkage error 322.5 Concluding comments 353 The data linkage environment 36Chris Dibben, Mark Elliot, Heather Gowans, Darren Lightfoot and Data Linkage Centres3.1 Introduction 363.2 The data linkage context 373.2.1 Administrative or routine data 373.2.2 The law and the use of administrative (personal) data for research 383.2.3 The identifiability problem in data linkage 423.3 The tools used in the production of functional anonymity through a data linkage environment 423.3.1 Governance, rules and the researcher 433.3.2 Application process, ethics scrutiny and peer review 433.3.3 Shaping ‘safe’ behaviour: training, sanctions, contracts and licences 433.3.4 ‘Safe’ data analysis environments 443.3.5 Fragmentation: separation of linkage process and temporary linked data 473.4 Models for data access and data linkage 503.4.1 Single centre 503.4.2 Separation of functions: firewalls within single centre 513.4.3 Separation of functions: TTP linkage 533.4.4 Secure multiparty computation 533.5 Four case study data linkage centres 543.5.1 Population Data BC 543.5.2 The Secure Anonymised Information Linkage Databank, United Kingdom 583.5.3 Centre for Data Linkage (Population Health Research Network), Australia 593.5.4 The Centre for Health Record Linkage, Australia 613.6 Conclusion 624 Bias in data linkage studies 63Megan Bohensky4.1 Background 634.2 Description of types of linkage error 654.2.1 Missed matches from missing linkage variables 654.2.2 Missed matches from inconsistent case ascertainment 664.2.3 False matches: Description of cases incorrectly matched 664.3 How linkage error impacts research findings 684.3.1 Results 684.3.2 Assessment of linkage bias 754.4 Discussion 784.4.1 Potential biases in the review process 794.4.2 Recommendations and implications for practice 795 Secondary analysis of linked data 83Raymond Chambers and Gunky Kim5.1 Introduction 835.2 Measurement error issues arising from linkage 845.2.1 Correct links, incorrect links and non]links 845.2.2 Characterising linkage errors 855.2.3 Characterising errors from non]linkage 865.3 Models for different types of linking errors 865.3.1 Linkage errors under binary linking 865.3.2 Linkage errors under multi]linking 885.3.3 Incomplete linking 885.3.4 Modelling the linkage error 895.4 Regression analysis using complete binary]linked data 905.4.1 Linear regression 915.4.2 Logistic regression 955.5 Regression analysis using incomplete binary]linked data 955.5.1 Linear regression using incomplete sample to register linked data 975.6 Regression analysis with multi]linked data 995.6.1 Uncorrelated multi]linking: Complete linkage 1005.6.2 Uncorrelated multi]linking: Sample to register linkage 1015.6.3 Correlated multi]linkage 1055.6.4 Incorporating auxiliary population information 1055.7 Conclusion and discussion 1076 Record linkage: A missing data problem 109Harvey Goldstein and Katie Harron6.1 Introduction 1096.2 Probabilistic Record Linkage (PRL) 1116.3 Multiple Imputation (MI) 1126.4 Prior-Informed Imputation (PII) 1136.4.1 Estimating matching probabilities 1156.5 Example 1: Linking electronic healthcare data to estimate trends in bloodstream infection 1156.5.1 Methods 1156.5.2 Results 1176.5.3 Conclusions 1186.6 Example 2: Simulated data including non]random linkage error 1186.6.1 Methods 1186.6.2 Results 1196.7 Discussion 1226.7.1 Non]random linkage error 1226.7.2 Strengths and limitations: Handling linkage error 1226.7.3 Implications for data linkers and data users 1237 Using graph databases to manage linked data 125James M. Farrow7.1 Summary 1257.2 Introduction 1267.2.1 Flat approach 1277.2.2 Oops, your legacy is showing 1287.2.3 Shortcomings 1287.3 Graph approach 1317.3.1 Overview of graph concepts 1317.3.2 Graph queries versus relational queries 1337.3.3 Comparison of data in flat database versus graph database 1367.3.4 Relaxing the notion of ‘truth’ 1377.3.5 Not a linkage approach per se but a management approach which enables novel linkage approaches 1387.3.6 Linkage engine independent 1397.3.7 Separates out linkage from cluster identification phase (and clerical review) 1397.4 Methodologies 1397.4.1 Overview of storage and extraction approach 1407.4.2 Overall management of data as collections 1417.4.3 Data loading 1427.4.4 Identification of equivalence sets and deterministic linkage 1437.4.5 Probabilistic linkage 1447.4.6 Clerical review 1447.4.7 Determining cut]off thresholds 1457.4.8 Final cluster extraction 1477.4.9 Graph partitioning 1477.4.10 Data management/curation 1507.4.11 User interface challenges 1507.4.12 Final cluster extraction 1547.4.13 A typical end]to]end workflow 1557.5 Algorithm implementation 1567.5.1 Graph traversal 1567.5.2 Cluster identification 1577.5.3 Partitioning visitor 1587.5.4 Encapsulating edge following policies 1587.5.5 Graph partitioning 1587.5.6 Insertion of review links 1587.5.7 How to migrate while preserving current clusters 1587.6 New approaches facilitated by graph storage approach 1587.6.1 Multiple threshold extraction 1607.6.2 Possibility of returning graph to end users 1657.6.3 Optimised cluster analysis 1667.6.4 Other link types 1677.7 Conclusion 1678 Large]scale linkage for total populations in official statistics 170Owen Abbott, Peter Jones and Martin Ralphs8.1 Introduction 1708.2 Current practice in record linkage for population censuses 1718.2.1 Introduction 1718.2.2 Case study: the 2011 England and Wales Census assessment of coverage 1728.3 Population]level linkage in countries that operate a population register: register]based censuses 1788.3.1 Introduction 1788.3.2 Case study 1: Finland 1798.3.3 Case study 2: The Netherlands Virtual Census 1808.3.4 Case study 3: Poland 1808.3.5 Case study 4: Germany 1818.3.6 Summary 1818.4 New challenges in record linkage: the Beyond 2011 Programme 1828.4.1 Introduction 1828.4.2 Beyond 2011 linking methodology 1838.4.3 The anonymisation process in Beyond 2011 1848.4.4 Beyond 2011 linkage strategy using pseudonymised data 1858.4.5 Linkage quality 1958.4.6 Next steps 1978.4.7 Conclusion 1988.5 Summary 1999 Privacy]preserving record linkage 201Rainer Schnell9.1 Introduction 2019.2 Chapter outline 2029.3 Linking with and without personal identification numbers 2029.3.1 Linking using a trusted third party 2039.3.2 Linking with encrypted PIDs 2049.3.3 Linking with encrypted quasi]identifiers 2049.3.4 PPRL in decentralised organisations 2049.4 PPRL approaches 2069.4.1 Phonetic codes 2069.4.2 High]dimensional embeddings 2069.4.3 Reference tables 2079.4.4 Secure multiparty computations for PPRL 2079.4.5 Bloom filter]based PPRL 2079.5 PPRL for very large databases: blocking 2099.5.1 Blocking for PPRL with Bloom filters 2109.5.2 Blocking Bloom filters with MBT 2119.5.3 Empirical comparison of blocking techniques for Bloom filters 2119.5.4 Current recommendations for linking very large datasets with Bloom filters 2139.6 Privacy considerations 2139.6.1 Probability of attacks 2149.6.2 Kind of attacks 2159.6.3 Attacks on Bloom filters 2159.7 Hardening Bloom filters 2179.7.1 Randomly selected hash values 2189.7.2 Random bits 2189.7.3 Avoiding padding 2209.7.4 Standardising the length of identifiers 2209.7.5 Sampling bits for composite Bloom filters 2219.7.6 Rehashing 2219.7.7 Salting keys with record]specific data 2239.7.8 Fake injections 2239.7.9 Evaluation of Bloom filter hardening procedures 2239.8 Future research 2249.9 PPRL research and implementation with national databases 22510 Summary 226Katie Harron, Chris Dibben and Harvey Goldstein10.1 Introduction 22610.2 Part 1: Data linkage as it exists today 22610.3 Part 2: Analysis of linked data 22710.3.1 Quality of identifiers 22710.3.2 Quality of linkage methods 22810.3.3 Quality of evaluation 22810.4 Part 3: Data linkage in practice: new developments 22910.5 Concluding remarks 231References 233Index 253