But Can You Use It? Design Recommendations for Practical Alternatives to Differentially Private Interactive Systems

Accessing data collected by federal statistical agencies is essential for public policy research and improving evidence-based decision making, such as evaluating the effectiveness of social programs, understanding demographic shifts, or addressing public health challenges. Differentially private interactive systems have been proposed as a crucial part of the data-sharing infrastructure. They could allow researchers to query targeted statistics, providing flexible, efficient access to specific insights, reducing the need for broad data releases and supporting timely, focused research. However, they have not yet been implemented in the real-world, and we argue that such systems which adhere to strict differential privacy are not practically feasible. Although substantial theoretical work has been conducted on the privacy and accuracy guarantees of differentially private mechanisms, prior efforts have not considered usability and accessibility as an explicit goal of interactive systems. This work outlines and considers the barriers to developing differentially private interactive systems for informing public policy and offers an alternative way forward. We propose balancing three design considerations: privacy assurance, statistical utility, and system usability. Based on these design considerations, we develop recommendations for making private interactive systems work in practice, outline an example architecture based on these recommendations, and provide an outline of how to conduct the necessary user-testing. Our work seeks to retain the underlying strengths of differentially private interactive systems, while making compromises in an effort to balance other goals. The solution we propose in this paper is not intended to be final, but rather it provides an example of applying our framework for future research on practical private interactive systems.