Privacy-Preserving Record Linkage in Population Data Systems: Leveraging Synthetic HDSS Data and Deterministic Identifier Masking for Machine Learning Models

Abstract

Background
Linking population-based datasets requires identifiable attributes that raise privacy and governance concerns. In low- and middle-income countries (LMIC), Health and Demographic Surveillance Systems (HDSS) are key sources of longitudinal population data. Synthetic data offers a privacy-preserving route for developing and evaluating record linkage (RL) methodologies without exposing sensitive microdata. This study introduces a framework that leverages Conditional Tabular Generative Adversarial Network (CTGAN)-generated synthetic HDSS data and deterministic name masking to support ethical RL and the development of supervised and ensemble machine-learning linkage models.

Methods
A CTGAN-based pipeline was applied to clean and harmonise Kisesa HDSS data to generate a statistically comparable synthetic dataset, while sex-specific deterministic name masking ensured full replacement of identifiers. Synthetic data quality was evaluated using distributional similarity, relationship preservation, and privacy-risk assessment. Synthetic adult clinic datasets were derived from the synthetic HDSS by introducing graded, field-specific error patterns via controlled probabilistic perturbations, creating conditions to evaluate RL models. Supervised models (logistic regression, random forest, gradient boosting, support vector machines) and an ensemble meta-classifier were trained and compared on these synthetic linkage tasks.

Results
The synthetic HDSS dataset preserved key demographic structures and multivariate dependencies, while deterministic masking eliminated direct identifiers. Across increasingly noisy error scenarios, supervised and ensemble models maintained strong match–nonmatch discrimination, with ensemble methods exhibiting the highest robustness as data quality deteriorated.

Conclusion
CTGAN-derived synthetic HDSS data combined with deterministic name masking provides a secure testbed for machine-learning-based RL, enabling ethical, reproducible, and governance-aligned population data linkage research in LMICs.