Primary and Secondary Purposes

Understanding the legal context for collection, approval mechanism,⁴ and transparency will be important to determine the appropriate mechanisms for sharing data, especially for secondary purposes.

• The data custodian may have collected information for a primary purpose, such as providing care to a patient.

• Or the data custodian may have collected information explicitly for a secondary purpose, such as constructing a database of patients with diabetes for subsequent research.

• Personal information may also come indirectly through one or more data custodians, where permitted.

• Alternatively, data may come from another source claiming to be anonymized (which may need to be assessed in its own right before being used or combined with personal information).

When properly anonymized, data are no long personal and therefore not subject to privacy legislation. But first the uses need to be understood to determine primary or secondary purposes, and determine legislative requirements.

• An agent, acting on behalf of the data custodian, may use personal data for a primary purpose.

• Depending on the jurisdiction, there may not be a legislative requirement to de-identify information that an agent uses for secondary purposes, or a requirement to obtain additional approval from data subjects for such uses. However, it may be encouraged or desirable.

• The data custodian may also receive a request to share with an internal or external recipient for some secondary purpose. Sharing of personal data are sometimes mandatory, whereas others may be discretionary to the data custodian. The conditions for discretionary sharing do vary.

• Other data sharing, that are not explicitly permitted in legislation, require that either approval be obtained from the data subjects or the personal data are anonymized.

When to De-Identify

There are circumstances in which we may not de-identify the data, even when describing secondary uses. But there are also circumstances in which we may want to de-identify for the sake of protecting privacy, and circumstances in which we must do it. We divide these into four scenarios to consider in deciding how the data can be shared, and what if any de-identification is needed.

Mandatory sharing

No approval is required, and the data do not require anonymization because it is likely that individuals need to be identified (e.g., law enforcement). However, there may be considerable underreporting by indivuals due to privacy concerns.

Internal sharing

It is often unnecessary for an agent to have data in identifiable form to perform their functions, even for primary purposes, and de-identification is desired to enhance privacy and avoid potential breaches.

Permitted sharing

Approval may be optional, under the discretion of the data custodian, for the public good (e.g., public health). There is reluctance, however, by data custodians to share personal data due to issues of individual and public trust, which de-identification can help remedy.

Other sharing

When approval is not possible or practical, and there are no exceptions in the legislation, the custodian must anonymize the personal data before sharing with a data recipient.

For our healthcare scientist, we’ll assume their desired use of the data falls within the category of “other data sharing”. Even if it had been a permited sharing scenario we would likely have wanted to anonymize the data, but given the legislative authority our risk tolerance would have been higher, meaning the release of more granular data.

Recipient Trust

We can begin to evaluate the likelihood of an attempt to re-identify by considering these potential adversaries. Consider the motives and capacity of the anticipated data recipient to re-identify the shared data. We assume that the data custodian is sharing data that have gone through some kind of de-identification.

Motives

The motive to re-identify individuals in the data implies an intentional re-identification, considering issues such as conflicts of interest and the potential for financial gain from a re-identification.

Capacity

The capacity to re-identify individuals in the data considers whether the data recipient has the skills and financial resources to re-identify the data.

Motives can be managed by having enforceable data sharing agreements or contracts with the data recipient. Such an agreement will determine how likely a deliberate re-identification attempt would be. Contractual obligations need to include very specific clauses (otherwise there are some very legitimate ways to re-identify a dataset):

• A prohibition on re-identification, on attempting to contact any of the patients in the data set, and on linking with other data sets without permission from the data custodian;

• An audit requirement that allows the data custodian to conduct spot checks to ensure compliance with the agreement, or a requirement for regular third-party audits;

• A prohibition on sharing the data with other third parties (so that the data custodian can keep track of who has the data), or a requirement to pass on the above restrictions to any other party the data is subsequently shared with.

You can imagine our healthcare researcher being resistant to some of these clauses. Of course these are all optional, and to be determined by the use case and governance that a data custodian wants to have in place, based on their risk tolerance. We often hear of organizations, for example, that prefer not to have restrictions on linking with other data sets. This can be managed somewhat by adding some fine print, such as no linking to identified data, or personal data, or with data that may increase identifiability.

Acquaintances

Recipient trust is about attempts to re-identify, but there is still a risk even when there is no attempt. Data recipients may have prior knowledge of personal information because they’re acquaintances of individuals in the data (remember our list of potential adversies in Figure 3-2). This in turn may lead them to re-identify inadvertently, or spontaneously (yes, that’s actually what it’s sometimes called!), simply by recognizing them. It’s a factor that needs to be considered when evaluating risk, because it relates to how safe it is to have people working with data.

Our healthcare scientist, and those working in their lab, provide a perfect example in the case that they are working with data in the same geography they’re in or are from. In order to know intimate information about an acquaintance, those individuals working with the data would need to be some kind of friend. We can therefore incorporate in our models the probability that the adversary knows someone in the defined population covered by the data.

VIPs are also at elevated risk, because more information about them is known publicly (we are all their acquaintance!). This would include individuals that are in the public realm often, and where there would be a media interest in writing about information that may be contained in the shared data, especially if they were unusual or pertinent to their public role. Typical VIPs would be politicians, actors and artists, and sports personalities.

A re-identification of a VIP may seem like a low likelihood event, although they are potentially more likely to be targets. A successful re-identifiation would, however, have a high impact, perhaps more damaging to public trust due to the increased media interest. The easiest approach to dealing with VIPs would be to remove them from shared data, rather than inflate the re-identification risk measurement for all data subjects. That being said, the transformations that are planned may be sufficient if identifiers known to acquaintances are included, and if the data is a sample.

Controlling Access, Disclosure, Retention, and Disposition of Personal Data

• Only authorized staff should have access to data, and only when they need it to do their jobs.

• There should be data sharing agreements in place with collaborators and subcontractors, and all of the above should have to sign nondisclosure or confidentiality agreements.

• There should be a data retention policy with limits on long-term use, and regular purging of data to reduce vulnerability to breaches.

• If any data is going to leave the relevant jurisdiction in which the data sharing is taking place, there should be enforceable data sharing agreements and policies in place to control disclosure to third parties.

Safeguarding Personal Data

• It’s important to respond to complaints or incidents, and that all staff receive privacy, confidentiality, and security training.

• Personnel need to be disciplined for violations of these policies and procedures, and there should be a tried and tested protocol for privacy breaches.

• Authentication measures must be in place with logs that can be used to investigate an incident.

• Data can be accessed remotely, but that access must be secure and logged.

• On the technical side, a regularly updated program needs to be in place to prevent malicious or mobile code from being run on servers, workstations and mobile devices, and data should be transmitted securely.

• It’s also necessary to have physical security in place to protect access to computers and files, with mandatory photo ID.

Ensuring Accountability and Transparency in the Management of Personal Data

• There should be someone in a position of seniority who is accountable for the privacy, confidentiality, and security of data, and there needs to be a way to contact that person.

• Internal or external auditing and monitoring mechanisms also need to be in place.

Risk Matrix

A detailed assessment of Safe Settings can be combined with our assessment of Safe People to create a standard risk matrix for an internal adversary, as shown in Figure 3-3. If you’ve ever seen a risk matrix before, they usually contain subjective entries. The entries in our risk matrix are, however, known as expert probabilities, which have been derived from past data releases by reputable organizations and regulatory or industry guidance.⁶

Figure 3-3. A risk matrix provides a visual demonstration of risks to assist decision making, and in this case expert probabilities are used so that more objective support can be provided in estimating re-identification risk.

Having expert probabilities, instead of subjective categories of low, medium, and high, allow us to combine the entries with measures of re-identification risk in the data itself, which we’ll see explicitly when we discuss Safe Data. This means that we can assign a probability of attempting to re-identify to our researcher and lab personnel. As can be seen from the risk matrix, the more we can trust the recipients, and the stronger the privacy and security settings, the lower the assigned probabily they will attempt to re-identify data.

Quantyfying Risk

Because risk measurement invariably requires the use of statistical methods, any risk measurement technique will be based on a model of plausible re-identification attacks, and models make assumptions about the real world. Therefore, risk measurement will always imply a series of assumptions that need to be made explicit. Furthermore, because of the statistical nature of risk measurement, there will also be uncertainty in these measurements and this uncertainty needs to be taken into account.

The risk measurement we’re referring to applies to indirectly identifying data. Three kinds of risks need to be managed, of which detailed metrics can be derived:¹⁰

Prosecutor risk

The prosecutor has background information about a specific person that is known to them, and uses this background information to search for a matching record in the shared data.

Journalist risk

The journalist doesn’t know the particular individual in the shared data, which is a subset of a larger public dataset, but does know that all the people in the data exist in a larger public dataset.

Marketer risk

The marketer is less concerned if some of the records are misidentified. Here the risk pertains to everyone in the data. Marketer risk is always less than prosecutor or journalist risk, and is therefore often ignored.

In practice either prosecutor or journalist risk are used, as they represent targeted attacks, whereas marketer risk is an average and will always be a lower probability. Prosecutor risk is used when a target individual is known to be in the shared data, whereas journalist risk is used when the target individual is in a larger defined population in which the shared data is only a sample. In other words, if the shared data represents the entire defined population, use prosecutor risk; if the shared data represents a sample from the defined population, use journalist risk.

If a population registry has information about individuals who are known to be in the shared data, an adversary may target the highest risk data subjects. In this case, the maximum of the risk metric is taken across all data subjects when there are no controls in place to prevent such an attack (e.g., public data sharing). On the other hand, if an adversary will not target the highest risk data subjects, because there are controls in place to prevent such an attack, but is trying to find information about a specific individual, the risk metric is averaged across all data subjects since target is random (e.g., private data sharing).

Invasion of Privacy

Invasion of privacy is a subjective criterion that can be used by the data custodian to influence the selection of a risk threshold. If the invasion of privacy is deemed to be high, that should skew the decision more toward a lower threshold. On the other hand, if the invasion of privacy is deemed to be low, a higher threshold would be selected.

• Are the data highly detailed, are they highly sensitive and personal in nature?

• What is the potential injury to individuals from an inappropriate processing of the data?

• What is the appropriateness of approval by data subjects for disclosing the data?

Although approval is not required of data subjects for sharing properly anonymized data, the sharing of data would not be considered as privacy invasive when approval has been provided by data subjects compared to when no approval is sought. There are in fact multiple levels of notice and approval that can exist for the sharing of anonymized data.

• There is court order or a provision in the relevant legislation permitting the sharing and use of the data without notice or approval of data subjects.

• The data were unsolicited or given freely or voluntarily by the data subjects with little expectation of it being maintained in total confidence.

• The data subjects have provided express approval that their data can be shared and used for this purpose when it was originally collected or at some point since then.

• The data custodian has consulted well-defined groups or communities regarding the sharing and use of the data and had a positive response.

• A strategy for informing or notifying the public about potential sharing and use for the data requestor’s purpose was in place when the data were collected or since then.

• Obtaining approval from data subjects at this point is inappropriate or impractical.

The practical consequence of evaluating invasion of privacy is that the suitable threshold (or the definition of “very small risk”) will be lower under the most invasive scenario. Even under the most invasive scenario, however, it is possible to share the data, but the degree of de-identification would be greater.

Figure 3-5. The risk threshold represents the maximum tolerable risk for sharing the data. This threshold needs to be quantitative and defensible. The expert probabilities in this diagram are based on past precedents.