Measurement
Part of Measuring multilingual social marketing without confusing attribution with cause
Suppressing small cells in a multilingual marketing dashboard
Protect people in a multilingual marketing dashboard: show the least detail needed, suppress small language cells, limit access by role and record the settings.
A dashboard can expose people even when no tile names anyone. Small language or market cells, linked account data and participant information all raise the risk. Decide how much detail each reader needs before anyone builds a tile, and treat the answer as part of the data protection design.
What to take away
- Show the least detail the decision needs, and set access, exports and retention by role.
- Suppress small cells using a stated threshold, then add secondary suppression so nothing can be recovered by subtraction.
- Never join inferred language labels to self-described ones.
- Publish the suppression method and note how it changes totals.
- Named privacy and PECR reviewers assess collection, joining and display.
Decide what each reader needs to see
Start from the decision, not the data. Each reader gets the detail their decision requires and no more, which is the same minimising habit that privacy law asks for.
The ICO says data protection by default means you must limit your use of personal information to what is necessary to achieve each specific purpose of your processing. It does not choose a lawful basis or approve a dashboard. Named privacy and PECR reviewers must assess collection, joining and display.
Record purpose and retention before any tile
Every field needs an owner, system, event, eligible population, type, unit, timezone, permitted values, geography, language identifier, collection purpose, refresh schedule and retention. A field without a stated purpose has no business on the dashboard.
Data contract fields per field
- Owner and system
- Event and eligible population
- Type, unit, timezone
- Permitted values and geography
- Source-language or asset-language identifier
- Collection purpose and refresh schedule
- Retention and missing-data rule
Keep self-described participant language separate from asset language. Do not derive comprehension, ethnicity, culture or preference from names, profiles or location.
For language joins, use ISO 639 codes and a lookup table. Record whether each language value is self-reported, an account setting or inferred, and never join inferred labels to self-described ones.
Suppress small cells and say how
Small cells are where disclosure risk sits. State the rule in advance, apply it to every edition and publish it beside the figures, so a reader knows why a cell is blank.
| Situation | Rule to apply |
|---|---|
| Any cell count below 5 | A common rule of thumb in UK official statistics is to suppress it |
| Language cells in smaller locales | A threshold of 10 may suit, but state the number you use |
| A suppressed cell recoverable from totals | Add secondary suppression |
| Suppression applied | Publish the method and note how it changes totals |
The Government Analysis Function explains that, to make sure suppressed cells cannot be derived by subtraction from totals, additional safe cells may need secondary suppression. Campaign dashboards are not official statistics, but the same reasoning protects the people in them.
Freeze the suppressed edition
Suppress at extraction, then freeze the result, so each edition shows the same cells when someone reproduces it. State when each source becomes available, when extraction begins and which late records enter the next edition.
Refresh and cut-off sequence
- Source becomes available
- Extraction begins
- Raw extract saved read-only
- Transformation version preserved
- Reconciliation totals checked
- Late records enter next edition
Save raw extracts read-only and keep the transformation code or workbook version with reconciliation totals. If a source revises history, keep the earlier published value, the corrected value, the reason, the approver and the affected decisions. Never overwrite the audit trail.
List the settings in a release manifest
Create one manifest per dashboard edition and store it outside the visual layer. It is the record that shows suppression was applied.
Manifest field / What to record
- Frozen input
- File names and hashes
- Versions
- Extraction and transformation versions
- Checks
- Reconciliation checks and unresolved exceptions
- Suppression
- Threshold, secondary suppression and its effect on totals
- Definitions
- Metric-definition version
- Sign-off
- Approvers and publication audience
The quality checks on each asset sit upstream of this manifest; the manifest covers the data, not the creative.
Label each tile so suppression is visible
Place the metric name, value, denominator or unit, period, timezone, source, refresh, query version, quality flag and uncertainty on or beside every tile. A reader who sees a blank cell can then check the note and learn that suppression, not a fault, caused it.
A refresh label should show source cut-off, extraction time, dashboard build time and version. Add the owner and the action rule for each tile, so a number never appears without someone responsible for acting on it.
The data-quality exception rate belongs beside suppressed figures. It shows whether a published measure is reliable enough to use, and it keeps a failed check apart from a deliberate blank.
Set access by role
Set row-level access, export permissions and retention by role. Show the least detail needed for the decision, and keep linked account data and participant information out of any view that does not need it.
Missing data needs its own states. Use distinct codes for no event, unavailable field, failed collection, suppressed cell, unmatched join and delayed report, and display the count and share of eligible records in each. A reader should never mistake a suppressed cell for zero. The wider measurement mistakes include that confusion.
A statistical reviewer should reproduce selected values from frozen inputs. Release only when privacy controls, correction history and decision ownership are complete.
Before you act
- Give every field a stated purpose, owner and retention period.
- Keep self-described and inferred language labels apart.
- Set and publish the suppression threshold, and add secondary suppression.
- Set row-level access, export permissions and retention by role.
- Record suppression settings in a manifest for every edition.
- Have named privacy and PECR reviewers sign off collection, joining and display.
Common questions
Why suppress small cells in a marketing dashboard?
Small language or market cells, linked account data and participant information raise disclosure risk. Suppression keeps individuals from being identified through a tile that looks harmless.
What is secondary suppression?
It hides additional safe cells so a suppressed cell cannot be recovered by subtraction from the totals. Publish the method and note how it changes totals.
Which threshold should a dashboard use?
A common rule of thumb in UK official statistics is to suppress counts below 5. A threshold of 10 may suit smaller locales. Whatever number you choose, state it.
