De-identification Risk and Resolution

29e Confrence internationale des commissaires à la protection de la vie prive

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 2929e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29thth INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS



De-identification Risk and Resolution

Bradley Malin, Ph.D.

Assistant Professor

Vanderbilt University



De-identified is not Anonymous(Sweeney 1998, 2000)

Zip

Birthdate

Sex

Name

Address

Date registered

Party affiliation

Date last voted

Voter List

Ethnicity

Visit date

Diagnosis

Procedure

Medication

Total charge

Hospital Discharge Data

87% of the United States is RE-IDENTIFIABLE



DNA Re-identification• Many deployed genomic privacy technologies leave DNA

susceptible to re-identification (Malin 2005)

• DNA is re-identified by automated methods, such as:– Genotype – Phenotype Inference (Malin & Sweeney, 2000, 2002)

MedicalDatabase

ICD9 code GeneticMutation

ICD9 codeHD GeneMutation

DNADatabase

3334 (CAG)n

(CAG)n3334



Genealogy Re-identification(Malin 2006)

• IdentiFamily:– software that links de-

identified pedigrees to named individuals

– Uses publicly available information, such as obituaries, death records, and the Social Security Death Index database to build genealogies

PublicResource

DeathRecords

PublicResource

PublicResource

Step 1: Extract

PopulationRecords

IdentifiedFamily Structures

Ada DanChazBob

FayEd

De-identified Pedigrees(Shared for Research)

Step 2: Validate

Step 3: StructureStep 4: Link



Genealogy Re-identification(Malin 2006)



System Susceptibility(Malin, JAMIA 2005)

Privacy Protection Systems

WhatTrusted

Third PartySemi-Trusted

Third PartyDenominalization De-identification

WheredeCode Genetics

Inc.

University of Gent,

Custodix

University of Montreal

University of Utah, University of Sydney, Australian National

University

Susceptibility to AttackFamily Structures

Trails

Genotype-Phenotype

Dictionary

Susceptible Not Susceptible



Altering Data Does notGuarantee Protection

• Science Magazine (Lin et al, 2004)

– < 100 “SNPs” make DNA unique– Proposed protection: perturb DNA

• i.e., change A with T, etc.

• aaaact atacct

– Increase perturbation, decrease internal correlations (see graph)

– Conclusions• Too much perturbation needed to

prevent linkage

• Keep records under lock and key

Privacy(Perturbation)

Uti

lity

(Co

rre

lati

on

s)

DISCLAIMER:Uniqueness Does not Guarantee

Privacy will be Compromised



Formal Re-identification Model

De-identifiedBiobank Data

Identified Data

aaactaaga

cacaccatg

tatatgatgt

John Doe

Jane Doe

Jeremiah Doe

Necessary ConditionUNIQUENESS

1. Make Data Non-unique

Necessary ConditionLINKAGEMODELC

2. Certify No Linkage Route

Already Public





Formal Protection

• k-Map (Sweeney, 2002)

– Each shared record refers to at least k entities in the population

• k-Anonymity (Sweeney, 2002)

– Each shared record is equivalent to at least k-1 other records

• k-Unlinkability (Malin 2006)

– Each shared record links to at least k identities via its trail– Satisfies k-Map protection model



Beyond Ad hoc Protections

• Perturbation does not guarantee privacy• Alternative: Generalization of data

ATCGATCGAT

ATACAACGTT

ATC[G or C]A[T or A]CG[T or A]T

Generalization

Perturbation

(Malin 2005)

(Lin et al 2004)



Learning Who You Are From Where You Have Been (“Trails”)

(Malin & Sweeney, 2001; 2004, Malin & Airoldi 2006)

ACTG1

ACTG2

ACTG3

H1 H2 H3

ACTG1

DNA in Genomic DBs

H1 H2 H3

Identities in Discharge DBs

ACTG2

ACTG3

ACTG1



0

20

40

60

80

100

0 10 20 30 40 50

k

% o

f D

NA

Rec

ord

s D

iscl

ose

d

NaivePartial Trail Suppression

Preventing Trails: Cystic Fibrosis Population(1149 samples)

0

20

40

60

80

100

0 10 20 30 40 50

k

% o

f S

am

ple

s R

e-i

de

nti

fie

d

BEFORE STRANON100% Samples In Repository

AFTER STRANON0% Samples k-Re-identified



Benefit: Quantified Risk

• Change in re-identification risk

• Shift burden of increased risk to requesting analyst

• Ties together legal and computational models

0

20

40

60

80

100

0 10 20 30 40 50

k

% o

f S

amp

les

in R

epo

sito

ry

InitialSetting

RequestedQuantity

ForcedSetting

De-identification Risk and Resolution

Documents

Transcript of De-identification Risk and Resolution