A new approach
The obvious solution is to directly measure the statistical disclosure risks involved in generating aggregate census data for particular sets of geographical output areas
Identify what is and what is not safe in an absolute statistical sense by measuring it
Then embed this risk assessment procedure in census output design systems to ensure a consistent and minimum level of disclosure safety