NOTE: We're currently in the process of rolling out the protections against indirect identification described below.
Maintaining individual participant confidentiality throughout the process of analyzing the aggregate results of a survey is crucial for ensuring that employees feel comfortable with continuing to provide open and honest feedback. Our reporting functions protect confidentiality whilst still maintaining the highest possible degree of analytical utility.
Culture Amp combines 2 different methods to protect the confidentiality of survey participants within reports:
- Protection from Direct Identification - preventing direct filtering on demographic groups with too few responses
- Protection from Indirect Identification - preventing filtering on demographic groups that leave behind remainder populations with too few responses
In both of these protections - “too few” responses is defined by the Reporting Group Minimum size. This value is set to 5 by default and is configurable.
In the below example, because there are only 4 participants from the Sales department, filtering on Department: Sales is disabled.
Also in the below example, subtracting the Technology department results from the Company Overall results will indirectly identify the Sales department results. Because of this, filtering on Department: Tech is disabled.
Example 1: Direct Identification vs Indirect Identification
In the below example, it is not possible to use the Department: Technology filter to indirectly identify a group with fewer than 5 participants. Applying this filter leaves behind a remainder population of 6 participants. Because of this, the filter is enabled.
Example 2: Indirect Identification is not possible when filters do not leave behind small remainder populations.
Our filter privacy rules will always disable the fewest amount of filters whilst still protecting the minimum reporting group from indirect identification.
In the below example, being able to filter on both Department: Tech and Department: Sales would allow for the indirect identification of Department: Science. Because both of these filters are needed for indirect identification, only one of them needs to be disabled. Because Sales is smaller, it is disabled. Science is also disabled because of direct identification.
If there were other departments with 6 or more participants, their filters would all be enabled.
Example 3: Indirect identification can be made impossible by disabling filters on one large group within a demographic, leaving all other large groups enabled.
- Can I adjust the Reporting Group Minimum size?
- The Reporting Group Minimum size is set to 5 by default and can be configured prior to a survey’s launch. Note that invitees are shown the Reporting Group Minimum size on the survey’s Welcome Screen and that lowering the Reporting Group Minimum could adversely impact your participation rates. Find out more here.
- Does this affect comments?
- There is a separate, independently configurable Reporting Group Minimum option for Comments (also set to 5 by default). It works exactly as above (protections from both forms of identification). Because of the information-rich nature of comments, we allow for the Comments Report to have stricter protections against direct and indirect identification than the rest of reporting e.g. if you choose to dial your Reporting Group Minimum value down to 3, you’re able to leave the Comments Reporting Group Minimum at 5.
- Does this affect report sharing?
- The creation of shared reports is exempt from protections against indirect identification. In Example 3, it would be possible to create a “Sales” shared report even though a “Sales” filter would not be enabled on an “All company” report.
- Does this affect lifecycle surveys?
- The Reporting Group Minimum for onboarding/exit surveys is defaulted to 1. If this value is raised, protections from direct and indirect identification will apply.
- With indirect identification, how will I know why a certain filter is disabled?
- When you try to apply a filter that is disabled, an error message that explains why it is disabled will be displayed.