CSVW-EO: The Metadata Standard for Eyes-Off Data Science

In this context, differential privacy (DP) plays a central role. At its core, DP is a mathematical framework designed to limit the risk that information about any specific individual can be extracted or inferred from the outputs of a statistical analysis. In other words, even when results are published or shared, DP provides a rigorous guarantee that the contribution of any single person to those results remains effectively hidden.

However, applying DP in practice is far from straightforward. Correctly implementing its protections requires precise knowledge of the data's structure, such as how many times a single individual may appear in a dataset, which categories are publicly known, and what assumptions can be safely made about the data's organisation. This is where metadata becomes essential: by formally documenting these structural properties, metadata provides the foundation upon which DP mechanisms can be correctly and safely calibrated.

In platforms implementing the Eyes-Off Data Science approach, such as Lomas, users must be able to understand the data available to them, even without ever directly accessing it. Specifically, they need to know what datasets are made available, how those datasets are structured, which types of statistical queries can be performed, and how to develop and test algorithms that incorporate DP protections. Meeting these needs without exposing the underlying data is precisely the challenge that a dedicated metadata standard is designed to address.

A key enabler in this context is the use of dummy datasets. These are datasets that faithfully reproduce the structural properties of the original data, such as its organisation, variable types, known categories, and internal dependencies, without containing any real or sensitive information. In essence, all values within a dummy dataset are randomly generated, yet they remain constrained by the structure of the original data, ensuring that the result is realistic in form, if not in content.

Although dummy datasets carry no actual information about any individual, they remain highly valuable in practice. They allow developers and researchers to build, test, and validate data algorithms in a realistic environment, verifying that their code runs correctly and produces outputs in the expected format, before ever interacting with the real, protected data.

To address these needs, we introduce CSVW-EO: a new metadata standard built as an extension of CSVW (CSV on the Web), an established W3C standard for describing tabular data. While CSVW was originally designed to document the structure and content types of a dataset, it does not account for the specific requirements of privacy-preserving data systems. The Eyes-Off extension closes this gap by adding two important layers: privacy-aware entries that support the correct application of DP, and structural modelling properties that enable the generation of realistic dummy datasets.

Concretely, CSVW-EO extends standard dataset descriptions with the following elements:

• Worst-case contribution bounds, which define the maximum number of times a single individual may appear in a dataset, a critical parameter for correctly calibrating DP protections.
• Public grouping keys, such as calendar months or administrative regions, which represent categories whose existence is already publicly known and can therefore be safely disclosed.
• Structural dependencies between variables, such as the constraint that a treatment date must always follow a patient's date of birth, which help ensure that generated dummy datasets remain realistic and internally consistent.
• Partition definitions, which describe how a dataset may be subdivided, for example, by filtering or grouping, and ensure that DP protections remain correctly calibrated across each resulting subset.
• Additional structural annotations that further characterise the organisation and properties of the data.

It is important to note that all of these fields are optional, and each must be carefully reviewed before being released alongside a dataset. This is because metadata itself can inadvertently leak sensitive information. To illustrate the distinction: stating that February 2026 has 28 days is safe, as it is publicly known and reveals nothing about any individual. By contrast, stating that a particular patient had five hospital visits in February 2026, even if that patient is not named, discloses information that could potentially be used to identify or profile an individual, and must therefore be treated with the same care as the underlying data.

Producing accurate and complete metadata is an inherently demanding task, requiring both technical precision and careful judgement. To support this process, we developed csvw-eo, an open-source Python library that accompanies the standard and covers the entire metadata workflow. Specifically, the library is capable of :

• Inferring a draft metadata file from an existing dataset, providing a starting point that significantly reduces manual effort.
• Generating dummy datasets from validated metadata, enabling algorithm development and testing in a privacy-safe environment.
• Validating metadata against both the CSVW-EO schema and a set of SHACL rules, a formal validation mechanism that checks the internal consistency and correctness of the metadata.

Connecting to established DP frameworks, such as OpenDP and SmartNoise SQL, allows practitioners to move seamlessly from metadata description to the practical application of privacy protections.

However, automation alone is not sufficient. Human oversight remains an essential part of the process at every stage, and most critically when reviewing automatically inferred metadata. As discussed earlier, metadata can inadvertently reveal sensitive information, and an automated system has no way of exercising the contextual judgement needed to detect such risks. Expert review is therefore not an optional step, but a fundamental safeguard.

Documentation is available at CSVW-EO, with source code at dscc-admin-ch/csvw-eo: Eyes-Off Data Science Extension of CSVW and distribution via csvw-eo · PyPI.