The simple process of re-identifying patients in public health records
pursuit.unimelb.edu.au
The simple process of re-identifying patients in public health records
1–10 of 13 posts
Re: The simple process of re-identifying patients in public health records
#2A friendly reminder that there's no such thing as "anonymized data", there's only "anonymized until combined with other data sets".
Re: The simple process of re-identifying patients in public health records
#3A friendly reminder that there's no such thing as "anonymized data", there's only "anonymized until combined with other data sets".
Personally I wouldn't be that pessimistic about data anonymization. It's entirely possible to robustly anonymize low-dimensional data sets and restrict the information gain of an attacker to a given value even when he/she has information about all non-sensitive attributes in the data set. When using e.g. k-anonymity (with additional l-diversity or better and t-closeness criteria) the resulting data is very robust against attacks, given you correctly specify your sensitive attributes. Of course there are more things to keep in mind, e.g. when repeatedly anonymizing different versions of the same data set (as this can cause data leakage).
Re: The simple process of re-identifying patients in public health records
#4A friendly reminder that there's no such thing as "anonymized data", there's only "anonymized until combined with other data sets".
Personally I wouldn't be that pessimistic about data anonymization. It's entirely possible to robustly anonymize low-dimensional data sets and restrict the information gain of an attacker to a given value even when he/she has information about all non-sensitive attributes in the data set. When using e.g. k-anonymity (with additional l-diversity or better and t-closeness criteria) the resulting data is very robust aga…
You are correct in theory, but there are so many conditions in your answer that you have really proven GP's point.
Even if you make sure that information gain about an individual from your dataset is minimal, this could easily change if combined with other data sets, as GP stated.
Re: The simple process of re-identifying patients in public health records
#5> but we now face the challenge of how to deliver that access, while protecting the privacy of the people in those datasets.
This is a losing battle. The information is already being leaked--we have been protected by the high cost and inaccessibility of analyzing it. These factors are quickly changing, and it's time to ask ourselves: how do we intend to live in a post-privacy world?
Re: The simple process of re-identifying patients in public health records
#6A friendly reminder that there's no such thing as "anonymized data", there's only "anonymized until combined with other data sets".
Furthermore (and to be the subject of much debate) there are actually genuinely useful things to be learned from large datasets in areas such as medicine, some of which don't even involve advertising/marketing, but it's very unclear if we can preserve genuine anonymity if we use that data.
Re: The simple process of re-identifying patients in public health records
#7A friendly reminder that there's no such thing as "anonymized data", there's only "anonymized until combined with other data sets".
Personally I wouldn't be that pessimistic about data anonymization. It's entirely possible to robustly anonymize low-dimensional data sets and restrict the information gain of an attacker to a given value even when he/she has information about all non-sensitive attributes in the data set. When using e.g. k-anonymity (with additional l-diversity or better and t-closeness criteria) the resulting data is very robust aga…
K-anonymity provides very little protection, if any. A few brief points:
1. I've never seen a formal definition of security that k-anon supposedly satisfies. While I personally really like formal guarantees, maybe one might argue this wouldn't be so bad absent concrete problems with the definition. Which leads us to...
2. K-anon doesn't compose. The JOIN of 2 databases, each k anonymized, can be 1-anonymous (i.e., no anonymity), no matter what k is.
3. The distinction between quasi-identifiers and sensitive attributes (central to the whole framework) is more than meaningless: is misleading. Every sensitive attributes is a quasi-identifier given the right auxiliary datasets. Using k anon essentially requires one to determine a priori which additional datasets will be used when attacking the k anonymized dataset.
4. My understanding of modified versions (diversity, closeness, etc) is less developed, but I believe they suffer similar weaknesses. The weaknesses are obscured by the additional definitional complexity.
(Edit: typos and autocorrect)
Re: The simple process of re-identifying patients in public health records
#8Black guy in remote Alaska village. Left leg and right hand amputated scenario. For anon you have to ditch geocoding; or aggregate symptoms across a population. IMHO anon should be good enough that the aggregated records become public domain.
Re: The simple process of re-identifying patients in public health records
#9A friendly reminder that there's no such thing as "anonymized data", there's only "anonymized until combined with other data sets".
Personally I wouldn't be that pessimistic about data anonymization. It's entirely possible to robustly anonymize low-dimensional data sets and restrict the information gain of an attacker to a given value even when he/she has information about all non-sensitive attributes in the data set. When using e.g. k-anonymity (with additional l-diversity or better and t-closeness criteria) the resulting data is very robust aga…
Is there any entity in the known universe with both the right incentives and at the same time is not completely incompetent and also are willing to spend enough resources on this - while not making any mistakes?
Anyone claiming to do this needs to be verified, that means that it has to be open. And being open does not by any stretch imply that it has been verified. And I will not do that just to use your product/site.
Bottom line: Just abandon and ignore anyone claiming to anonymize sensitive data.
Re: The simple process of re-identifying patients in public health records
#10"anonymized" is a statistical measure. What you are doing is making it less likely that someone can be identified not necessarily impossible. I think it would be best if folks were more honest about that. The article mentions finding 7 people in a dataset of 2.9 million. It's obvious that they felt that 7 prominent people was enough to tell the story and they could likely find many more. My question is could they find 0.001%, 1%, 10%, or more? If so with what resources...
Edit: an old an interesting discussion on this: https://news.ycombinator.com/item?id=2942967